Description

Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-react-editor) in Progress Software KendoReact versions 2.7.0 through 16.1.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via a link with an unsafe URL in the Editor content, which runs when the user clicks the link.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-11-06T17:17:12.367Z",
  "pubdate": "2026-11-06T17:17:12.367Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the @progress/kendo-react-editor component of the Progress Software KendoReact suite, specifically affecting versions 2.7.0 through 16.1.0.\nThe vulnerability originates from improper sanitization of user-supplied content, specifically regarding URL attributes within the Editor component.\nAn attacker with low-privileged access to the Editor can inject malicious payloads via unsafe URL structures, such as 'javascript:' protocols, within hyperlinks.\nWhen an unsuspecting user interacts with the crafted link, the payload executes in the victim's browser context.\nThis vulnerability poses a significant risk, as successful exploitation permits unauthorized execution of arbitrary JavaScript. Potential impacts include session hijacking, account takeover, unauthorized data exfiltration, and the performance of actions on behalf of the victim within the application.\nExploitation requires the attacker to successfully supply content to the Editor that is subsequently rendered for other users, making this a stored XSS vector.",
  "technicalDetails": "The vulnerability is rooted in the @progress/kendo-react-editor component's failure to adequately validate and sanitize hyperlink attributes, specifically the 'href' attribute within anchor tags. The component lacks a strict allowlist for URL schemes, permitting the injection of pseudo-protocols such as 'javascript:'.\nAffected versions include @progress/kendo-react-editor 2.7.0 through 16.1.0. The vulnerability allows an attacker who has permission to input content into the Editor to embed an '<a>' tag containing a malicious URI.\nThe attack flow proceeds as follows: First, the attacker crafts a payload where the 'href' attribute of an anchor tag is assigned a value like 'javascript:alert(document.cookie)'. Second, the attacker inputs this HTML snippet into the Editor component. The component fails to intercept or neutralize the 'javascript:' protocol during the saving or rendering process.\nThird, the malicious content is stored in the application's backend database. Finally, when another user—potentially a higher-privileged user or administrator—views the content generated by the Editor, the browser renders the link. Upon the victim clicking the malicious link, the browser executes the JavaScript payload defined in the 'href' attribute within the origin context of the application.\nBecause the payload executes in the victim's session, the attacker inherits the victim's authentication tokens, session cookies, and permissions. This enables the attacker to bypass CSRF protections, capture sensitive information stored in local or session storage, or manipulate the DOM to perform unauthorized administrative actions or exfiltrate user data to a remote attacker-controlled server.\nThe vulnerability is classified as stored XSS because the payload is persisted within the application's content storage. The severity is magnified by the fact that the Editor component is often used in administrative dashboards or collaborative environments, significantly increasing the probability of interaction with high-value targets."
}