CVE-2026-106135

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-106135", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "state": "PUBLISHED", "assignerShortName": "ProgressSoftware", "dateReserved": "2026-10-06T15:51:08.623Z", "datePublished": "2026-11-06T16:47:50.663Z", "dateUpdated": "2026-11-06T17:45:58.191Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2026-11-06T16:47:50.663Z"}, "title": "Cross-Site Scripting in Progress Software Kendo UI for Angular", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-18", "descriptions": [{"lang": "en", "value": "CAPEC-18 XSS Targeting Non-Script Elements"}]}], "affected": [{"vendor": "Progress Software", "product": "Kendo UI for Angular", "collectionURL": "https://www.npmjs.com", "packageName": "@progress/kendo-angular-conversational-ui", "versions": [{"status": "affected", "version": "0", "lessThan": "25.3.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-angular-conversational-ui) in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in another user's browser via an unsafe URL in an openUrl quick action, which runs when the user clicks the action.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Cross-Site Scripting (XSS) in the Chat component (<code>@progress/kendo-angular-conversational-ui</code>) in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in another user's browser via an unsafe URL in an <code>openUrl</code> quick action, which runs when the user clicks the action."}]}], "references": [{"url": "https://www.telerik.com/kendo-angular-ui/components/knowledge-base/kb-security-chat-xss-cve-2026-106135", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}}], "credits": [{"lang": "en", "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-06T17:18:29.994499Z", "id": "CVE-2026-106135", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T17:45:58.191Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-106135", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T17:18:29.994499Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T17:45:51.643Z"}}], "cna": {"title": "Cross-Site Scripting in Progress Software Kendo UI for Angular", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"}], "impacts": [{"capecId": "CAPEC-18", "descriptions": [{"lang": "en", "value": "CAPEC-18 XSS Targeting Non-Script Elements"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Progress Software", "product": "Kendo UI for Angular", "versions": [{"status": "affected", "version": "0", "lessThan": "25.3.0", "versionType": "semver"}], "packageName": "@progress/kendo-angular-conversational-ui", "collectionURL": "https://www.npmjs.com", "defaultStatus": "unaffected"}], "references": [{"url": "https://www.telerik.com/kendo-angular-ui/components/knowledge-base/kb-security-chat-xss-cve-2026-106135", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-angular-conversational-ui) in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in another user's browser via an unsafe URL in an openUrl quick action, which runs when the user clicks the action.", "supportingMedia": [{"type": "text/html", "value": "Cross-Site Scripting (XSS) in the Chat component (<code>@progress/kendo-angular-conversational-ui</code>) in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in another user's browser via an unsafe URL in an <code>openUrl</code> quick action, which runs when the user clicks the action.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2026-11-06T16:47:50.663Z"}}}, "cveMetadata": {"cveId": "CVE-2026-106135", "state": "PUBLISHED", "dateUpdated": "2026-11-06T17:45:58.191Z", "dateReserved": "2026-10-06T15:51:08.623Z", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "datePublished": "2026-11-06T16:47:50.663Z", "assignerShortName": "ProgressSoftware"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://www.npmjs.com", "defaultStatus": "unaffected", "packageName": "@progress/kendo-angular-conversational-ui", "product": "Kendo UI for Angular", "vendor": "Progress Software", "versions": [{"lessThan": "25.3.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@progress.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-angular-conversational-ui) in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in another user's browser via an unsafe URL in an openUrl quick action, which runs when the user clicks the action."}], "id": "CVE-2026-106135", "lastModified": "2026-11-06T20:38:53.570", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security@progress.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-106135", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T17:18:29.994499Z", "version": "2.0.3"}}]}, "published": "2026-11-06T17:17:11.930", "references": [{"source": "security@progress.com", "url": "https://www.telerik.com/kendo-angular-ui/components/knowledge-base/kb-security-chat-xss-cve-2026-106135"}], "sourceIdentifier": "security@progress.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@progress.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,25.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Kendo UI for Angular", "source": "cna", "vendor": "Progress Software"}, "product": "kendo_ui_for_angular", "vendor": "progress"}], "created": "2026-11-06T18:30:09.442492+00:00", "updated": "2026-11-09T17:13:15.034076+00:00", "vendors": ["progress", "progress$PRODUCT$kendo_ui_for_angular"]}