Description

Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-angular-editor) in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via a link or image with an unsafe URL in the Editor content, which runs when the user interacts with it.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-11-06T17:17:12.213Z",
  "pubdate": "2026-11-06T17:17:12.213Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the @progress/kendo-angular-editor component of the Progress Software Kendo UI for Angular framework. This security flaw affects versions prior to 25.3.0.\nThe vulnerability enables a low-privileged attacker, who possesses the capability to supply or manipulate content within the Editor, to execute arbitrary JavaScript in the browser context of another user.\nBy embedding malicious payloads disguised as links or images containing unsafe URLs, an attacker can trigger execution when a target user interacts with the compromised content. This flaw poses a significant risk to application integrity and user session security, as it allows for unauthorized code execution within the security boundary of the victim's session.\nSuccessful exploitation requires the victim to interact with the crafted content, effectively bypassing standard input sanitization mechanisms. Organizations utilizing affected versions are encouraged to upgrade immediately to mitigate potential unauthorized access, session hijacking, or data exfiltration scenarios.",
  "technicalDetails": "The vulnerability stems from improper neutralization of user-supplied input within the @progress/kendo-angular-editor component. Specifically, the component fails to adequately validate or sanitize URL attributes (such as 'href' in anchor tags or 'src' in image tags) before rendering them in the DOM.\nThe root cause is a failure in the sanitization logic during the parsing and rendering process of the Editor's content. When the component processes HTML inputs, it does not sufficiently restrict the protocol schemes allowed for link or image attributes. Consequently, malicious payloads utilizing the 'javascript:' URI scheme—or other unsafe patterns—are permitted to bypass the intended security controls.\nThe attack flow proceeds as follows: First, an attacker with input access to the Editor component injects a crafted HTML snippet. This snippet includes an element (e.g., an <a> or <img> tag) where the source or destination attribute contains a 'javascript:' payload. Because the @progress/kendo-angular-editor does not effectively strip or neutralize these URI schemes, the malicious string is rendered into the document structure as a valid attribute.\nWhen a legitimate user—such as an administrator or another user with higher privileges—views or interacts with this content, the browser interprets the 'javascript:' protocol as an instruction to execute the embedded code. Because this script executes within the context of the user's active session, the attacker gains the ability to perform actions on behalf of the victim, access session tokens, or modify the Document Object Model (DOM) to further propagate the attack.\nThe impact of successful exploitation is broad. Since the script executes with the victim's permissions, it can bypass traditional server-side security measures by acting through the client's validated session. This facilitates potential data theft, unauthorized modification of application data, or redirection to malicious third-party domains.\nThis vulnerability is present in all versions of the @progress/kendo-angular-editor prior to 25.3.0. Exploitation does not require elevated administrative privileges; a low-privileged user capable of interacting with the Editor interface is sufficient to initiate the attack vector."
}