Cross-Site Scripting Vulnerability in @progress/kendo-angular-editor
Summary
GHSA-j7wp-vjj6-cp5m: Cross-Site Scripting in @progress/kendo-angular-editor. Affects @progress/kendo-angular-editor versions < 1.2.3. Fixed in 1.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @progress/kendo-angular-editor is a package in the npm ecosystem that provides a rich text editor component for Angular applications. It allows users to create and edit content with various formatting options. However, an identified vulnerability in versions prior to 1.2.3 exposes the application to Cross-Site Scripting (XSS) attacks. This means that if the editor content contains malicious scripts in element event handlers, they can be executed when the content is rendered.
Vulnerability Detail
The Cross-Site Scripting vulnerability in @progress/kendo-angular-editor arises due to insufficient input sanitization. When the editor content includes potentially harmful scripts in event handlers, such as <img src="" onerror=alert(document.domain)>, these scripts are executed when the content is displayed. This can lead to various security risks, including unauthorized access, data theft, and the potential for further exploitation of the affected application.
How To Fix
Latest published version: 25.3.0 as of 22 Oct 2026
npm install @progress/kendo-angular-editor@25.3.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.3
This is the first release that contains the fix.
npm install @progress/kendo-angular-editor@1.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to manually sanitize the editor content before rendering it. This can be done by using a library or function that sanitizes HTML input, removing any potentially harmful scripts. It is important to ensure that the sanitization process is thorough and covers all possible attack vectors.
Conclusion
The Cross-Site Scripting vulnerability in @progress/kendo-angular-editor exposes applications to the risk of executing malicious scripts within the editor content. To mitigate this vulnerability, it is crucial to upgrade to version 1.2.3 or later of the package. Additionally, manually sanitizing the editor content before rendering can serve as a temporary workaround. For further assistance, please contact DevNack.com.
See every vulnerability recorded for @progress/kendo-angular-editor →
FAQ
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. These scripts can be used to steal sensitive information, perform unauthorized actions, or deface the website.
The vulnerability in @progress/kendo-angular-editor allows an attacker to inject and execute malicious scripts within the editor content. This can lead to various security risks, including unauthorized access, data theft, and potential further exploitation of the application.
Yes, the vulnerability has been fixed in version 1.2.3 of the @progress/kendo-angular-editor package. It is recommended to upgrade to this version or later to ensure the application is protected against the Cross-Site Scripting vulnerability.
A temporary workaround is to manually sanitize the editor content before rendering it. This involves using a library or function that sanitizes HTML input, removing any potentially harmful scripts. However, upgrading to the latest version of the package is the recommended long-term solution.
For further support or assistance in fixing this vulnerability, you can reach out to info@devnack.com. Our team of experts can provide guidance and help ensure your application is secure.
