---
id: CVE-2026-106135
title: Cross-Site Scripting in Progress Software Kendo UI for Angular
summary: >-
  Cross-Site Scripting (XSS) in the Chat component
  (@progress/kendo-angular-conversational-ui) in Progress Software Kendo UI for
  Angular versions prior to 25.3.0 allows a low-privileged attacker who can
  supply Chat messages to execute arbi…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: Progress Software
product: '@progress/kendo-angular-conversational-ui'
affected:
  - '@progress/kendo-angular-conversational-ui < 25.3.0'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T17:18:29.994499Z'
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:45:58.191Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-106135'
references:
  - url: >-
      https://www.telerik.com/kendo-angular-ui/components/knowledge-base/kb-security-chat-xss-cve-2026-106135
tags:
  - cve.org
ingestedAt: '2026-11-06T16:57:43.123Z'
epss: 0.00173
epssPercentile: 0.06763
---

## Overview

Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-angular-conversational-ui) in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in another user's browser via an unsafe URL in an openUrl quick action, which runs when the user clicks the action.

## Affected

- `@progress/kendo-angular-conversational-ui < 25.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.