CVE-2026-106135 · Package
NO FIX YET · SEE WHAT TO DO
The Chat component in Kendo UI for Angular (@progress/kendo-angular-conversational-ui) fails to sanitize a URL in the openUrl quick action. An attacker who can send Chat messages can run JavaScript in another user's browser when that user clicks the action.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Apps built with the Kendo UI for Angular Chat component that show messages from other users and allow quick actions. Apps that do not use the Chat component, or that only show trusted content, are less exposed. The sources do not say whether the flaw needs a particular configuration beyond using openUrl quick actions.
Not affected if no-chat-component, trusted-messages-only
Who cares angular, conversational-ui, kendo-ui, web-frontend
@progress/kendo-angular-conversational-ui in package.json and the lock file.@progress/kendo-angular-conversational-ui (Kendo UI for Angular): move to 25.3.0 or laterCross-Site Scripting (XSS) in the Chat component (@progress/kendo-angular-conversational-ui) in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in another user's browser via an unsafe URL in an openUrl quick action, which runs when the user clicks the action.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.