What is GHSA-425v-fpc7-7pw2?

GHSA-425v-fpc7-7pw2 is a security advisory published by GitHub Security Advisories with Medium severity. Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-angular-conversational-ui) in...

Which CVE IDs does GHSA-425v-fpc7-7pw2 cover?

GHSA-425v-fpc7-7pw2 covers the following CVE IDs: CVE-2026-106135. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-425v-fpc7-7pw2?

GHSA-425v-fpc7-7pw2 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

GHSA-425v-fpc7-7pw2MediumCVSS 5.4

Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-angular-conversational-ui) in...

Vendor

GitHub Security Advisories

Published

November 6, 2026

Last Modified

November 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-106135 →

📋 Description

Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-angular-conversational-ui) in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in another user's browser via an unsafe URL in an openUrl quick action, which runs when the user clicks the action.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-106135
https://www.telerik.com/kendo-angular-ui/components/knowledge-base/kb-security-chat-xss-cve-2026-106135
https://github.com/advisories/GHSA-425v-fpc7-7pw2