Description

Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-angular-conversational-ui) in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in another user's browser via an unsafe URL in an openUrl quick action, which runs when the user clicks the action.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-11-06T17:17:11.930Z",
  "pubdate": "2026-11-06T17:17:11.930Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the Chat component of the @progress/kendo-angular-conversational-ui library in Progress Software Kendo UI for Angular. This flaw allows low-privileged attackers to inject malicious payloads into chat messages that are subsequently rendered within the victim's session.\nThe vulnerability resides in the handling of the 'openUrl' quick action feature, which fails to adequately sanitize or validate provided URLs. An attacker capable of submitting chat messages can weaponize this functionality to trigger arbitrary JavaScript execution when a victim interacts with the compromised action.\nSuccessful exploitation results in the execution of unauthorized scripts in the context of the user's browser, potentially leading to session hijacking, unauthorized actions, or credential theft. This vulnerability affects versions prior to 25.3.0. The risk is considered high, as it enables stored XSS attacks that require minimal user interaction to trigger, effectively weaponizing the conversational interface against authenticated users.",
  "technicalDetails": "The vulnerability is a stored Cross-Site Scripting (XSS) flaw located within the @progress/kendo-angular-conversational-ui Chat component. The root cause is improper sanitization of inputs associated with 'openUrl' quick actions. When the component processes these actions, it fails to perform necessary validation on the URL scheme or the structural integrity of the link, allowing the injection of pseudo-protocols or malicious URI schemes.\nThe attack flow begins when an attacker, possessing low-privileged access capable of sending chat messages, transmits a specially crafted payload within the 'openUrl' action definition of a message. Because the component does not strictly enforce URL validation before rendering this action in the UI, the browser treats the malicious input as a valid action to be executed upon user interaction.\nWhen a victim views the chat interface and clicks the attacker-supplied quick action, the browser interprets the malicious URL. If the URL utilizes a 'javascript:' pseudo-protocol, the victim's browser context immediately executes the embedded script. Because the script executes within the origin of the Kendo UI application, the attacker gains the ability to perform any action the user is authorized to perform.\nThis execution context allows for the exfiltration of session cookies, sensitive local storage data, or the manipulation of the Document Object Model (DOM) to capture user inputs or spoof UI elements. Furthermore, the attack is persistent; as long as the malicious message remains in the chat history, any user who views and clicks the action is susceptible to the payload.\nThe vulnerability affects all versions of the @progress/kendo-angular-conversational-ui component prior to 25.3.0. Exploitation does not require elevated administrative privileges, only the ability to supply chat content. The impact is significant, as it bypasses standard expectations of safe input handling within the conversational UI framework, turning a legitimate user-interface feature into an attack vector for code injection."
}