CVE-2026-106142 · Package
NO FIX YET · SEE WHAT TO DO
The Editor component in the @progress/kendo-react-editor package does not block unsafe URLs in links, so a low-privileged user can insert a link that runs JavaScript when another user clicks it. The attacker can run script in the victim's browser session, which can expose data or actions available to that user.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that use the KendoReact Editor component to let users enter or edit rich content that other users then view. Apps that never render user-supplied Editor content, or that only use the Editor for trusted content, are less exposed. The sources do not say whether any sanitisation in the host application mitigates this.
Not affected if no-user-supplied-editor-content, versions-outside-range
Who cares kendo-react, react, web-apps
@progress/kendo-react-editor (for example with npm ls @progress/kendo-react-editor).@progress/kendo-react-editor: move to a version later than 16.1.0 (the fixed version is not stated in the sources; unknown)Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-react-editor) in Progress Software KendoReact versions 2.7.0 through 16.1.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via a link with an unsafe URL in the Editor content, which runs when the user clicks the link.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.