{"id":"CVE-2026-106141","kind":"vulnerability","aliases":["CVE-2026-106141"],"related":[],"title":"Kendo UI Angular Editor: stored XSS via unsafe link or image URL","description":"Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-angular-editor) in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via a link or image with an unsafe URL in the Editor content, which runs when the user interacts with it.","summary":"The Editor component in Kendo UI for Angular (@progress/kendo-angular-editor) before 25.3.0 does not block unsafe URLs in links and images. A low-privileged user who can enter Editor content can run JavaScript in another user's browser when that user clicks or interacts with the element.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["angular","frontend","kendo-ui","package"],"not_affected_if":["no-kendo-editor","single-user-content"],"how_to_check":"- Check the installed version of `@progress/kendo-angular-editor` in package.json or the lockfile.\n- Search the app for uses of the Editor component that render user-supplied content back to other users.","fix":"- `@progress/kendo-angular-editor` (Kendo UI for Angular): move to `25.3.0` or later.","status":"open","published_at":"2026-11-06T17:17:12+00:00","first_seen_at":"2026-11-06T17:43:12+00:00","triaged_at":"2026-11-06T17:45:26+00:00","updated_at":"2026-11-06T17:45:26+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T17:45:26Z","model":"claude-haiku-5-5","output":{"fix":"- `@progress/kendo-angular-editor` (Kendo UI for Angular): move to `25.3.0` or later.","reach":"internet","title":"Kendo UI Angular Editor: stored XSS via unsafe link or image URL","impact":"medium","summary":"The Editor component in Kendo UI for Angular (@progress/kendo-angular-editor) before 25.3.0 does not block unsafe URLs in links and images. A low-privileged user who can enter Editor content can run JavaScript in another user's browser when that user clicks or interacts with the element.","audience":"developers","category":"package","nicknames":[],"who_cares":["angular","kendo-ui","frontend"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs JavaScript in another user's browser session","analyst_note":"","how_to_check":"- Check the installed version of `@progress/kendo-angular-editor` in package.json or the lockfile.\n- Search the app for uses of the Editor component that render user-supplied content back to other users.","plain_action":"","needs_analyst":false,"not_affected_if":["no-kendo-editor","single-user-content"],"who_is_affected":"Applications that use the Kendo UI for Angular Editor component and let one user's Editor content be shown to other users are exposed. Apps that use the Editor only for private content, or that do not use this package, can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000688,"input_tokens":4271,"output_tokens":521,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-106141':15A,18A '-2026':14A,17A '25.3.0':35B,92C 'allow':93C 'angular':3A,19B,32B,88C 'anoth':59B,109C 'arbitrari':106C 'attack':98C 'block':38B 'browser':62B,112C 'click':66B 'compon':27B,80C 'content':54B,103C,125C 'cross':73C 'cross-sit':72C 'cve':13A,16A 'editor':4A,26B,53B,79C,102C,124C 'element':71B 'enter':52B 'execut':105C 'frontend':20B 'imag':11A,44B,117C 'interact':68B,131C 'javascript':57B,107C 'kendo':1A,22B,29B,85C 'kendo-ui':21B 'link':9A,42B,115C 'low':47B,96C 'low-privileg':46B,95C 'packag':24B 'prior':90C 'privileg':48B,97C 'progress':83C 'progress/kendo-angular-editor':33B,81C 'run':56B,127C 'script':75C 'site':74C 'softwar':84C 'store':5A 'suppli':101C 'ui':2A,23B,30B,86C 'unsaf':8A,39B,120C 'url':12A,40B,121C 'user':49B,60B,65B,110C,130C 'version':89C 'via':7A,113C 'xss':6A,76C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the Kendo UI for Angular Editor component and let one user's Editor content be shown to other users are exposed. Apps that use the Editor only for private content, or that do not use this package, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["angular","frontend","kendoui","medium","package"],"campaign_type":null,"search_a":"'-106141':15A,18A '-2026':14A,17A 'angular':3A 'cve':13A,16A 'editor':4A 'imag':11A 'kendo':1A 'link':9A 'store':5A 'ui':2A 'unsaf':8A 'url':12A 'via':7A 'xss':6A","search_b":"'25.3.0':35B 'angular':19B,32B 'anoth':59B 'block':38B 'browser':62B 'click':66B 'compon':27B 'content':54B 'editor':26B,53B 'element':71B 'enter':52B 'frontend':20B 'imag':44B 'interact':68B 'javascript':57B 'kendo':22B,29B 'kendo-ui':21B 'link':42B 'low':47B 'low-privileg':46B 'packag':24B 'privileg':48B 'progress/kendo-angular-editor':33B 'run':56B 'ui':23B,30B 'unsaf':39B 'url':40B 'user':49B,60B,65B","search_c":"'25.3.0':92C 'allow':93C 'angular':88C 'anoth':109C 'arbitrari':106C 'attack':98C 'browser':112C 'compon':80C 'content':103C,125C 'cross':73C 'cross-sit':72C 'editor':79C,102C,124C 'execut':105C 'imag':117C 'interact':131C 'javascript':107C 'kendo':85C 'link':115C 'low':96C 'low-privileg':95C 'prior':90C 'privileg':97C 'progress':83C 'progress/kendo-angular-editor':81C 'run':127C 'script':75C 'site':74C 'softwar':84C 'suppli':101C 'ui':86C 'unsaf':120C 'url':121C 'user':110C,130C 'version':89C 'via':113C 'xss':76C","first_public_at":"2026-11-06T17:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106141","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106141","severity":null,"published_at":"2026-11-06T17:17:12+00:00","modified_at":"2026-11-06T17:17:12+00:00","first_seen_at":"2026-11-06T17:43:12+00:00","fetched_at":"2026-11-06T17:43:12+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}