---
id: "CVE-2026-106135"
page: "https://infrastack.ai/live/CVE-2026-106135"
kind: "vulnerability"
aliases: ["CVE-2026-106135"]
title: "Kendo UI for Angular Chat: XSS via openUrl quick action in messages"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["angular", "conversational-ui", "kendo-ui", "package", "web-frontend"]
not_affected_if: ["no-chat-component", "trusted-messages-only"]
published_at: "2026-11-06T17:17:11+00:00"
first_seen_at: "2026-11-06T17:43:12+00:00"
updated_at: "2026-11-06T17:45:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106135", "first_seen_at": "2026-11-06T17:43:12+00:00"}]
exploit_sources: []
---

# Kendo UI for Angular Chat: XSS via openUrl quick action in messages

Link for people: https://infrastack.ai/live/CVE-2026-106135 (this .md is for agents)

The Chat component in Kendo UI for Angular (@progress/kendo-angular-conversational-ui) fails to sanitize a URL in the openUrl quick action. An attacker who can send Chat messages can run JavaScript in another user's browser when that user clicks the action.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of `@progress/kendo-angular-conversational-ui` in `package.json` and the lock file.
- Look for uses of the Chat component that render messages with quick actions from untrusted users.

## Fix

- `@progress/kendo-angular-conversational-ui` (Kendo UI for Angular): move to `25.3.0` or later

## Timeline

- 2026-11-06T17:43:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106135

## From the sources

Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-angular-conversational-ui) in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in another user's browser via an unsafe URL in an openUrl quick action, which runs when the user clicks the action.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_