---
id: "CVE-2026-106143"
page: "https://infrastack.ai/live/CVE-2026-106143"
kind: "vulnerability"
aliases: ["CVE-2026-106143"]
title: "Kendo UI for Vue editor: unsafe link lets scripts run in other users' browsers"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["javascript", "kendo-ui", "package", "vue"]
not_affected_if: ["no-editor-component", "single-user-content", "versions-outside-range"]
published_at: "2026-11-06T17:17:12+00:00"
first_seen_at: "2026-11-06T17:43:12+00:00"
updated_at: "2026-11-06T17:45:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106143", "first_seen_at": "2026-11-06T17:43:12+00:00"}]
exploit_sources: []
---

# Kendo UI for Vue editor: unsafe link lets scripts run in other users' browsers

Link for people: https://infrastack.ai/live/CVE-2026-106143 (this .md is for agents)

The Editor component in @progress/kendo-vue-editor accepts an unsafe URL from the Insert Link or Insert Image dialog. When another user clicks the resulting link, attacker-supplied JavaScript runs in their browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of `@progress/kendo-vue-editor` in `package.json` and the lockfile.
- Look for any use of the Editor component that renders user-supplied content for other users.

## Fix

- Versions 2.7.1 through 10.0.0 are affected; the sources do not state a fixed version.

## Timeline

- 2026-11-06T17:43:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106143

## From the sources

Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-vue-editor) in Progress Software Kendo UI for Vue versions 2.7.1 through 10.0.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via an unsafe URL entered in the Insert Link or Insert Image dialog, which runs when the user clicks the resulting link.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_