CVE-2026-106142: Cross-Site Scripting in Progress Software KendoReact

Published Nov 6, 2026

Updated

Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-react-editor) in Progress Software KendoReact versions 2.7.0 through 16.1.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via a link with an unsafe URL in the Editor content, which runs when the user clicks the link.

Event History

Nov 6, 2026

CVE Published

via MITRE·04:56 PM

Data Sourced

via MITRE·04:56 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Applications using the KendoReact Editor component are exposed if they allow a low-privileged user to supply Editor content that will later be viewed by other users. The attack requires a victim to click a link with an unsafe URL embedded in that content.

What does an attacker need to exploit it?

The attacker needs the ability to provide content to the Editor component. They can place a link using an unsafe URL in that content; arbitrary JavaScript executes in another user's browser when that user clicks the link.

Which versions are affected?

The affected range is Progress Software KendoReact versions 2.7.0 through 16.1.0, specifically the @progress/kendo-react-editor Editor component.

CVE-2026-106142: Cross-Site Scripting in Progress Software KendoReact

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Which versions are affected?