Is CVE-2026-106143 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106143 being exploited in the wild.

How severe is CVE-2026-106143?

Medium severity, with a CVSS score of 5.4, published 6 November 2026.

Which products and versions are affected?

Progress Software Kendo UI for Vue 2.7.1 through 10.0.0.

Is there a fix for CVE-2026-106143?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-106143 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-106143?

Check whether you run Progress Software Kendo UI for Vue at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106143: Progress Kendo UI for Vue Editor cross-site scripting

CVE-2026-106143 · Severity: medium · CVSS 5.4 · Published 2026-11-06

Progress Kendo UI for Vue is a library of interactive UI components used in web applications. An attacker with the ability to supply content to the Editor component can inject malicious links that execute arbitrary JavaScript when another user clicks them, potentially leading to session hijacking, credential theft, or other malicious actions in the victim's browser.

Vendors: Progress Software.

Quick answers

Is CVE-2026-106143 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106143 being exploited in the wild.
How severe is CVE-2026-106143?: Medium severity, with a CVSS score of 5.4, published 6 November 2026.
Which products and versions are affected?: Progress Software Kendo UI for Vue 2.7.1 through 10.0.0.
Is there a fix for CVE-2026-106143?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-106143 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-106143?: Check whether you run Progress Software Kendo UI for Vue at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Editor component in Kendo UI for Vue fails to properly sanitize unsafe URLs in the Insert Link and Insert Image dialogs, allowing an authenticated attacker to inject JavaScript-based URIs (such as javascript: or data: schemes). When a user clicks the resulting link or loads the image, the malicious script executes in their browser context, achieving stored or reflected XSS depending on deployment. The vulnerability affects versions 2.7.1 through 10.0.0.

Affected products

Progress Software Kendo UI for Vue 2.7.1 through 10.0.0

Timeline

2026-11-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.