Description

Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-vue-editor) in Progress Software Kendo UI for Vue versions 2.7.1 through 10.0.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via an unsafe URL entered in the Insert Link or Insert Image dialog, which runs when the user clicks the resulting link.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-11-06T17:17:12.510Z",
  "pubdate": "2026-11-06T17:17:12.510Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the @progress/kendo-vue-editor component, affecting versions 2.7.1 through 10.0.0. This flaw permits a low-privileged user capable of supplying content to the Editor to inject malicious scripts via the Insert Link or Insert Image dialog functionality.\nThe vulnerability occurs because the component fails to properly sanitize unsafe URL protocols, such as 'javascript:', when processing user-supplied data. Consequently, when an unsuspecting user interacts with the injected element, the payload executes within the security context of the victim's browser session.\nThe impact of this vulnerability is significant, as it facilitates the execution of arbitrary JavaScript, potentially leading to unauthorized actions, session hijacking, or the exfiltration of sensitive information. The attack is restricted to users who have existing permissions to populate the editor interface, but it does not require administrative privileges to initiate the exploit chain.",
  "technicalDetails": "The vulnerability is rooted in improper input validation and sanitization of URI-based attributes within the @progress/kendo-vue-editor component. Specifically, the editor's internal logic for handling the 'Insert Link' and 'Insert Image' dialogs fails to restrict the 'href' or 'src' attributes to safe URI schemes (such as 'http:', 'https:', or 'mailto:').\nBy bypassing client-side validation or intercepting the input process, an attacker can supply a malicious URI using the 'javascript:' pseudo-protocol. When the editor renders this content, it stores the malicious script payload within the document structure. The vulnerability manifests when the resulting DOM element (e.g., an <a> or <img> tag) is parsed and rendered in the viewer's browser.\nThe attack flow proceeds as follows: First, the attacker uses the Editor component to insert a link or image, embedding a payload such as 'javascript:alert(document.cookie)' into the URL field. Second, the application saves this malformed data as part of the Editor's content. Third, when a victim navigates to or interacts with the content containing the link, the browser executes the JavaScript embedded in the attribute. This occurs because the browser interprets the 'javascript:' prefix as a valid instruction to execute code rather than navigate to a resource.\nBecause the execution occurs in the context of the victim's current application session, the malicious script can access Document Object Model (DOM) elements, manipulate page content, access local storage, or transmit session tokens to a remote attacker-controlled server. This vulnerability does not require complex network manipulation; it relies solely on the trust placed in the data rendered by the component after being submitted by an authenticated user with low-level authoring privileges.\nThe flaw affects all versions from 2.7.1 up to and including 10.0.0. Remediation is required at the component level to implement strict URL protocol allowlisting, ensuring that only expected URI schemes are processed during the dialog's input handling phase."
}