{"id":"CVE-2026-106143","kind":"vulnerability","aliases":["CVE-2026-106143"],"related":[],"title":"Kendo UI for Vue editor: unsafe link lets scripts run in other users' browsers","description":"Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-vue-editor) in Progress Software Kendo UI for Vue versions 2.7.1 through 10.0.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via an unsafe URL entered in the Insert Link or Insert Image dialog, which runs when the user clicks the resulting link.","summary":"The Editor component in @progress/kendo-vue-editor accepts an unsafe URL from the Insert Link or Insert Image dialog. When another user clicks the resulting link, attacker-supplied JavaScript runs in their browser.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["javascript","kendo-ui","package","vue"],"not_affected_if":["no-editor-component","single-user-content","versions-outside-range"],"how_to_check":"- Check the installed version of `@progress/kendo-vue-editor` in `package.json` and the lockfile.\n- Look for any use of the Editor component that renders user-supplied content for other users.","fix":"- Versions 2.7.1 through 10.0.0 are affected; the sources do not state a fixed version.","status":"open","published_at":"2026-11-06T17:17:12+00:00","first_seen_at":"2026-11-06T17:43:12+00:00","triaged_at":"2026-11-06T17:45:24+00:00","updated_at":"2026-11-06T17:45:24+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T17:45:24Z","model":"claude-haiku-5-5","output":{"fix":"- Versions 2.7.1 through 10.0.0 are affected; the sources do not state a fixed version.","reach":"internet","title":"Kendo UI for Vue editor: unsafe link lets scripts run in other users' browsers","impact":"medium","summary":"The Editor component in @progress/kendo-vue-editor accepts an unsafe URL from the Insert Link or Insert Image dialog. When another user clicks the resulting link, attacker-supplied JavaScript runs in their browser.","audience":"developers","category":"package","nicknames":[],"who_cares":["kendo-ui","vue","javascript"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker script runs in another user's browser session","analyst_note":"Confirm the fixed version and any vendor workaround from the Progress Kendo UI for Vue advisory; the NVD entry alone gives no fix.","how_to_check":"- Check the installed version of `@progress/kendo-vue-editor` in `package.json` and the lockfile.\n- Look for any use of the Editor component that renders user-supplied content for other users.","plain_action":"","needs_analyst":true,"not_affected_if":["no-editor-component","single-user-content","versions-outside-range"],"who_is_affected":"Applications built with Kendo UI for Vue 2.7.1 through 10.0.0 that let users enter Editor content which other users then view. Exposure depends on whether Editor output is displayed to other users and whether links are rendered as clickable. Teams that do not use the Editor component, or that only edit content privately, are unlikely to be exposed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000729,"input_tokens":4287,"output_tokens":600,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-106143':17A,20A '-2026':16A,19A '10.0.0':79C '2.7.1':77C 'accept':32B 'allow':80C 'anoth':45B,96C 'arbitrari':93C 'attack':52B,85C 'attacker-suppli':51B 'browser':14A,58B,99C 'click':47B,118C 'compon':29B,67C 'content':90C 'cross':60C 'cross-sit':59C 'cve':15A,18A 'dialog':43B,112C 'editor':5A,28B,66C,89C 'enter':104C 'execut':92C 'imag':42B,111C 'insert':38B,41B,107C,110C 'javascript':21B,54B,94C 'kendo':1A,23B,72C 'kendo-ui':22B 'let':8A 'link':7A,39B,50B,108C,121C 'low':83C 'low-privileg':82C 'packag':25B 'privileg':84C 'progress':70C 'progress/kendo-vue-editor':31B,68C 'result':49B,120C 'run':10A,55B,114C 'script':9A,62C 'site':61C 'softwar':71C 'suppli':53B,88C 'ui':2A,24B,73C 'unsaf':6A,34B,102C 'url':35B,103C 'user':13A,46B,97C,117C 'version':76C 'via':100C 'vue':4A,26B,75C 'xss':63C","nicknames":[],"mitigations":[],"who_affected":"Applications built with Kendo UI for Vue 2.7.1 through 10.0.0 that let users enter Editor content which other users then view. Exposure depends on whether Editor output is displayed to other users and whether links are rendered as clickable. Teams that do not use the Editor component, or that only edit content privately, are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["javascript","kendoui","medium","package","vue"],"campaign_type":null,"search_a":"'-106143':17A,20A '-2026':16A,19A 'browser':14A 'cve':15A,18A 'editor':5A 'kendo':1A 'let':8A 'link':7A 'run':10A 'script':9A 'ui':2A 'unsaf':6A 'user':13A 'vue':4A","search_b":"'accept':32B 'anoth':45B 'attack':52B 'attacker-suppli':51B 'browser':58B 'click':47B 'compon':29B 'dialog':43B 'editor':28B 'imag':42B 'insert':38B,41B 'javascript':21B,54B 'kendo':23B 'kendo-ui':22B 'link':39B,50B 'packag':25B 'progress/kendo-vue-editor':31B 'result':49B 'run':55B 'suppli':53B 'ui':24B 'unsaf':34B 'url':35B 'user':46B 'vue':26B","search_c":"'10.0.0':79C '2.7.1':77C 'allow':80C 'anoth':96C 'arbitrari':93C 'attack':85C 'browser':99C 'click':118C 'compon':67C 'content':90C 'cross':60C 'cross-sit':59C 'dialog':112C 'editor':66C,89C 'enter':104C 'execut':92C 'imag':111C 'insert':107C,110C 'javascript':94C 'kendo':72C 'link':108C,121C 'low':83C 'low-privileg':82C 'privileg':84C 'progress':70C 'progress/kendo-vue-editor':68C 'result':120C 'run':114C 'script':62C 'site':61C 'softwar':71C 'suppli':88C 'ui':73C 'unsaf':102C 'url':103C 'user':97C,117C 'version':76C 'via':100C 'vue':75C 'xss':63C","first_public_at":"2026-11-06T17:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106143","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106143","severity":null,"published_at":"2026-11-06T17:17:12+00:00","modified_at":"2026-11-06T17:17:12+00:00","first_seen_at":"2026-11-06T17:43:12+00:00","fetched_at":"2026-11-06T17:43:12+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}