CVE-2026-106135 in Kendo UI for Angular
Summary
by MITRE • 11/06/2026
Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-angular-conversational-ui) in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in another user's browser via an unsafe URL in an openUrl quick action, which runs when the user clicks the action.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified as Cross-Site Scripting within the Progress Software Kendo UI for Angular library specifically affects the conversational chat component prior to version 25.3.0. This security flaw resides in how the application handles quick actions, particularly those involving URL navigation via the openUrl function. The core technical issue stems from insufficient sanitization of user-supplied input when it is processed as part of a link or action trigger within the chat interface. When an attacker who possesses low-privileged access to the system can inject malicious payloads into chat messages, these payloads are not adequately validated before being rendered in the browser context of other users. The vulnerability manifests specifically through the openUrl quick action mechanism, which is designed to navigate the user to a specified web address when clicked by the recipient.
From a technical perspective, this flaw represents a classic stored Cross-Site Scripting scenario where malicious JavaScript code is embedded within data that appears legitimate until it is executed in the victim's browser environment. The attacker crafts a chat message containing an unsafe URL structure or script injection point disguised as part of the quick action configuration. Because the application trusts the input from the authenticated user without applying strict output encoding or validation rules, the malicious script becomes active when another user interacts with the component by clicking the intended action button. This execution occurs within the security context of the victim's session, allowing the injected code to access cookies, local storage, and other sensitive browser data associated with that domain.
The operational impact of this vulnerability is significant for organizations relying on real-time communication features built into their web applications. An attacker can exploit this flaw to perform a variety of malicious activities including stealing user authentication tokens, hijacking active sessions, performing actions on behalf of the victim without consent, or redirecting users to phishing sites designed to capture credentials. Since the attack vector requires only low-privileged access and simple interaction from the victim such as clicking a link within a chat message, the likelihood of successful exploitation is high in environments where trust between participants is assumed but not technically enforced at the application level. This undermines the integrity and confidentiality of communications facilitated by the Kendo UI component.
To mitigate this risk, organizations must immediately upgrade to version 25.3.0 or later of Progress Software Kendo UI for Angular, which includes patches addressing these input validation deficiencies. In cases where an immediate upgrade is not feasible, temporary mitigations should include implementing strict Content Security Policy headers that restrict script execution from unauthorized sources and disabling the openUrl quick action if it is not strictly required by business operations. Additionally, developers should review any custom implementations of chat components to ensure that all user-supplied URLs are sanitized using robust libraries designed for URL validation and encoding before they are passed to browser navigation functions or rendered in HTML contexts.
This vulnerability aligns with Common Weakness Enumeration category CWE-79 which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. It also maps to MITRE ATT&CK technique T1059 which describes Command and Scripting Interpreter execution, specifically how attackers use browser-based scripts to achieve their objectives without deploying traditional malware binaries on the target system. Understanding these mappings helps security teams prioritize remediation efforts based on standardized frameworks that reflect real-world attack patterns and defensive strategies against web application vulnerabilities.