Read the docs
TI-2026-86030 Aliases CVE-2026-106143GHSA-38f5-57r3-974w

Cross-site scripting in Progress Software Kendo UI for Vue editor

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Progress Software Kendo UI for Vue from 2.7.1 before 10.1.0 contains a cross-site scripting flaw (CWE-79) in the Editor component (@progress/kendo-vue-editor). A low-privileged attacker who can supply Editor content can run arbitrary JavaScript in another user's browser through an unsafe URL, which runs when that user clicks the resulting link.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-vue-editor) in Progress Software Kendo UI for Vue versions 2.7.1 through 10.0.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via an unsafe URL entered in the Insert Link or Insert Image dialog, which runs when the user clicks the resulting link.

Why it matters now

EPSS 0.00133 2nd percentileScored 2026-11-07
Fix Fixed Kendo UI for Vue (Progress Software): 10.1.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ProgressKendo UI for Vue2.7.1 to before 10.1.010.1.0Patch availableCNA
  • Kendo UI for Vue VendorProgress Affected 2.7.1 to before 10.1.0 Fixed in 10.1.0 Patch available CNA

Remediation

Update Progress Software Kendo UI for Vue to version 10.1.0.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Kendo UI for Vue (Progress Software) Fixed in 10.1.0

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-106143
  2. 2026-11-06 Alias added: GHSA-38f5-57r3-974w
  3. 2026-11-08 Priority changed: MEDIUM → LOW

References

Advisory 1

  • TI-2026-07083 Command injection in Progress LoadMaster KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-06182 WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-04541 WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-04060 Registration Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-01127 LoadMaster Pre-Authenticated OS Command Injection KEVCVSS 3.1CRITICAL 10.0
  • TI-2023-20934 WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability KEVCVSS 3.1CRITICAL 10.0
See all 436 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences