CVE-2026-106143 in Kendo UI for Vue
Summary
by MITRE • 11/06/2026
Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-vue-editor) in Progress Software Kendo UI for Vue versions 2.7.1 through 10.0.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via an unsafe URL entered in the Insert Link or Insert Image dialog, which runs when the user clicks the resulting link.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified as Cross-Site Scripting within the Progress Software Kendo UI for Vue editor component represents a significant security risk to web applications utilizing this library. Specifically affecting versions 2.7.1 through 10.0.0, the flaw resides in how the Editor handles user-supplied content when inserting hyperlinks or images. The core technical issue stems from an insufficient validation of URL inputs provided by users with low privileges who have access to the editor interface. When a malicious actor supplies a crafted URL containing executable JavaScript code within the Insert Link or Insert Image dialog, the application fails to properly sanitize this input before rendering it in the DOM. This lack of rigorous output encoding allows the browser to interpret and execute the embedded script as if it were legitimate content from the trusted origin hosting the web application.
From an operational perspective, this vulnerability enables a stored or reflected cross-site scripting attack depending on how the editor content is persisted. If the malicious link is saved within document content that other users subsequently view, the impact escalates to a persistent threat vector. The execution of arbitrary JavaScript occurs in the context of another user's browser session when they interact with the compromised element by clicking the resulting link or image placeholder. This interaction triggers the payload, granting the attacker the ability to perform actions on behalf of the victim. Such capabilities typically include stealing sensitive cookies and authentication tokens, hijacking active sessions, performing unauthorized transactions, defacing the application interface, or redirecting users to malicious phishing sites designed to harvest credentials.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-79, which classifies improper neutralization of input during web page generation as a classic cross-site scripting flaw. The attack vector is categorized under MITRE ATT&CK technique T1059, specifically subtechnique 007 for JavaScript execution, and falls within the initial access or persistence phases depending on whether the payload leads to immediate compromise or long-term foothold establishment. The severity of this issue is compounded by its reliance on user interaction, which makes it difficult to detect via automated scanning tools that do not simulate click events, yet highly effective against human users who trust the application interface.
Mitigation strategies must address both the immediate code-level deficiencies and broader architectural controls. Developers should immediately upgrade the @progress/kendo-vue-editor package to a version beyond 10.0.0 where this specific sanitization logic has been corrected. In instances where upgrading is not feasible, implementing strict Content Security Policy headers can significantly reduce the impact by preventing inline script execution and restricting sources of executable content. Additionally, applying robust input validation on the server side ensures that even if client-side protections are bypassed or absent, malicious payloads are rejected before being stored in persistent storage. Utilizing a dedicated HTML sanitization library configured with strict allow-lists for URL schemes can further harden the application against such injection attempts by ensuring only safe protocols like HTTP and HTTPS are permitted without embedded script handlers.