# CVE-2026-106135: Progress Kendo UI for Angular XSS in Chat component

Source: https://junglewise.ai/threats/cve-2026-106135-cross-site-scripting-xss-in-the-chat-component-progress-kendo  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-106135 · Severity: medium · CVSS 5.4 · Published 2026-11-06

Progress Kendo UI for Angular is a component library used to build web applications; its Chat component is vulnerable to cross-site scripting (XSS). An attacker with the ability to supply chat messages can inject malicious code that executes in another user's browser when they click an openUrl quick action, potentially stealing credentials or hijacking user sessions.

Technologies: [Progress Software Kendo UI for Angular](https://junglewise.ai/threats/technologies/kendo-ui-for-angular). Vendors: [Progress Software](https://junglewise.ai/threats/vendors/progress-software).

## Quick answers

**Is CVE-2026-106135 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106135 being exploited in the wild.

**How severe is CVE-2026-106135?** Medium severity, with a CVSS score of 5.4, published 6 November 2026.

**Which products and versions are affected?** Progress Software Kendo UI for Angular prior to 25.3.0.

**Is there a fix for CVE-2026-106135?** Yes: fixed in 25.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106135 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-106135?** Check whether you run Progress Software Kendo UI for Angular at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 25.3.0

## Technical details

The vulnerability is an XSS flaw in the Chat component's openUrl quick action handler, which fails to properly sanitize URLs. An authenticated or low-privileged attacker who can compose or inject chat messages can craft a malicious URL in an openUrl action; when a user clicks the action, arbitrary JavaScript executes in their browser context. A fix is available in version 25.3.0 and later.

## Affected products

- Progress Software Kendo UI for Angular prior to 25.3.0

## Timeline

- 2026-11-06: disclosed

## References

- [https://www.npmjs.com/](https://www.npmjs.com/)
- [https://www.telerik.com/kendo-angular-ui/components/knowledge-base/kb-security-chat-xss-cve-2026-106135](https://www.telerik.com/kendo-angular-ui/components/knowledge-base/kb-security-chat-xss-cve-2026-106135)

## Related threats

- [Progress Kendo UI Angular prototype pollution in Scheduler](https://junglewise.ai/threats/cve-2026-106144-prototype-pollution-in-the-scheduler-component-progress-kendo)
- [Progress Kendo UI for Angular Editor XSS via unsafe URL](https://junglewise.ai/threats/cve-2026-106141-cross-site-scripting-xss-in-the-editor-component-progress-kendo)