Is CVE-2026-106135 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106135 being exploited in the wild.

How severe is CVE-2026-106135?

Medium severity, with a CVSS score of 5.4, published 6 November 2026.

Which products and versions are affected?

Progress Software Kendo UI for Angular prior to 25.3.0.

Is there a fix for CVE-2026-106135?

Yes: fixed in 25.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-106135 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-106135?

Check whether you run Progress Software Kendo UI for Angular at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106135: Progress Kendo UI for Angular XSS in Chat component

CVE-2026-106135 · Severity: medium · CVSS 5.4 · Published 2026-11-06

Progress Kendo UI for Angular is a component library used to build web applications; its Chat component is vulnerable to cross-site scripting (XSS). An attacker with the ability to supply chat messages can inject malicious code that executes in another user's browser when they click an openUrl quick action, potentially stealing credentials or hijacking user sessions.

Technologies: Progress Software Kendo UI for Angular. Vendors: Progress Software.

Quick answers

Is CVE-2026-106135 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106135 being exploited in the wild.
How severe is CVE-2026-106135?: Medium severity, with a CVSS score of 5.4, published 6 November 2026.
Which products and versions are affected?: Progress Software Kendo UI for Angular prior to 25.3.0.
Is there a fix for CVE-2026-106135?: Yes: fixed in 25.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106135 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-106135?: Check whether you run Progress Software Kendo UI for Angular at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 25.3.0

Technical details

The vulnerability is an XSS flaw in the Chat component's openUrl quick action handler, which fails to properly sanitize URLs. An authenticated or low-privileged attacker who can compose or inject chat messages can craft a malicious URL in an openUrl action; when a user clicks the action, arbitrary JavaScript executes in their browser context. A fix is available in version 25.3.0 and later.

Affected products

Progress Software Kendo UI for Angular prior to 25.3.0

Timeline

2026-11-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.