A stored Cross‑Site Scripting flaw exists in the chat component of Progress Software Kendo UI for Angular. The bug allows a low‑privileged attacker who can supply chat messages to embed an unsafe URL as a quick action named openUrl. When a user clicks that quick action, the browser executes the attacker‑supplied JavaScript. This flaw falls under CWE‑79 and permits arbitrary code execution in the victim’s browser, enabling data theft, session hijacking, or phishing attacks. The impact is confined to users who view the compromised chat message and does not provide direct access to the server or other users’ data.

Vendors: Progress Software; Product: Kendo UI for Angular. The vulnerability affects all releases of the @progress/kendo-angular-conversational-ui package that are older than version 25.3.0. Users of earlier releases should upgrade to 25.3.0 or later where the issue is fixed.

The overall CVSS score is 5.4, indicating moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting it is not yet a widely used exploit. However, the attack vector is a web‑based vector that requires an attacker to be able to inject a chat message containing an unsafe URL. Once a user clicks the injected quick action, the malicious script runs in their browser. No additional privileges or server‑side access are required to attack or exploit the flaw; the threat is limited to the endpoint user’s browser environment.