Description

Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-react-conversational-ui) in Progress Software KendoReact versions 0.6.0 through 16.1.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in the origin of the application via an unsafe URL in an openUrl quick action, which runs when a user clicks the action.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-11-06T17:17:12.077Z",
  "pubdate": "2026-11-06T17:17:12.077Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the @progress/kendo-react-conversational-ui component of Progress Software KendoReact versions 0.6.0 through 16.1.0.\nThe vulnerability originates from the improper sanitization of URL schemes provided within the 'openUrl' quick action configuration of the Chat component.\nBy supplying a malicious message containing a crafted URL, a low-privileged attacker can force the application to execute arbitrary JavaScript within the security context of the victim's session.\nThe successful exploitation of this vulnerability permits unauthorized script execution in the origin of the host application, potentially leading to session hijacking, sensitive data exfiltration, or unauthorized actions performed on behalf of the authenticated user.\nThe risk is categorized as critical for applications that allow user-supplied content to be rendered within the chat interface without strict input validation or Content Security Policy (CSP) enforcement.",
  "technicalDetails": "The vulnerability resides in the @progress/kendo-react-conversational-ui component, specifically within the handling mechanism for 'openUrl' quick actions. The component fails to sufficiently validate or sanitize the target URL provided in the message schema before invoking the action upon a user click.\nThe root cause is the lack of protocol validation for the URI provided to the quick action handler. If the Chat component receives a message containing an 'openUrl' action where the URL uses the 'javascript:' pseudo-protocol, the browser interprets the instruction as executable code rather than a navigation target.\nThe exploitation flow begins when an attacker, possessing low-privileged access, injects a message into the chat stream containing a specially crafted quick action object. The 'url' field of the action is set to a malicious JavaScript payload, such as 'javascript:alert(document.cookie)'.\nWhen a victimized user clicks the button rendered by the Chat component for this quick action, the component triggers an implicit navigation or execution event that evaluates the provided 'javascript:' string. This evaluation occurs within the origin of the web application, granting the injected script full access to the Document Object Model (DOM), local storage, session storage, and cookies associated with that origin.\nThis vulnerability is classified as Stored or Reflected XSS depending on the persistence of the message within the application backend. In either scenario, the attacker does not require elevated privileges to initiate the payload delivery, provided they have the capability to transmit a chat message that the component subsequently renders.\nPost-exploitation, the attacker can leverage the XSS to perform actions such as hijacking the current session, modifying the rendered chat content, redirecting the user to malicious external sites, or capturing sensitive data tokens displayed within the interface. The lack of restrictive input validation at the component level allows these payloads to bypass standard client-side protections, necessitating a fix within the library's event handling logic to enforce an allow-list of safe protocols, such as 'http:' and 'https:'."
}