Is CVE-2026-106142 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106142 being exploited in the wild.

How severe is CVE-2026-106142?

Medium severity, with a CVSS score of 5.4, published 6 November 2026.

Which products and versions are affected?

Progress Software KendoReact 2.7.0 through 16.1.0.

Is there a fix for CVE-2026-106142?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-106142 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-106142?

Check whether you run Progress Software KendoReact at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106142: Progress KendoReact Editor cross-site scripting

CVE-2026-106142 · Severity: medium · CVSS 5.4 · Published 2026-11-06

The KendoReact Editor component, used in web applications to allow users to create and edit content, is vulnerable to cross-site scripting (XSS) attacks. An attacker with the ability to insert content into the editor can inject malicious links that execute JavaScript when clicked by other users, potentially leading to session hijacking, credential theft, or unauthorized actions on their behalf.

Technologies: Progress Software KendoReact. Vendors: Progress Software.

Quick answers

Is CVE-2026-106142 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106142 being exploited in the wild.
How severe is CVE-2026-106142?: Medium severity, with a CVSS score of 5.4, published 6 November 2026.
Which products and versions are affected?: Progress Software KendoReact 2.7.0 through 16.1.0.
Is there a fix for CVE-2026-106142?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-106142 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-106142?: Check whether you run Progress Software KendoReact at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the Editor component's handling of unsafe URLs within links inserted into editor content. A low-privileged attacker who can supply content to the editor can craft a malicious link that executes arbitrary JavaScript in another user's browser context when the link is clicked. The flaw affects versions 2.7.0 through 16.1.0 and requires user interaction (clicking the link) to trigger the attack.

Affected products

Progress Software KendoReact 2.7.0 through 16.1.0

Timeline

2026-11-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.