Medium severity5.4NVD Advisory· Published Nov 6, 2026· Updated Nov 6, 2026

CVE-2026-106135

Description

Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-angular-conversational-ui) in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in another user's browser via an unsafe URL in an openUrl quick action, which runs when the user clicks the action.

Affected products

Process Software/Kendo UI for Angularllm-fuzzy
Range: <25.3.0
Telerik/Kendo UI for Angularllm-fuzzy
Range: <25.3.0

Patches

Vulnerability mechanics

References

www.telerik.com/kendo-angular-ui/components/knowledge-base/kb-security-chat-xss-cve-2026-106135nvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000