Cross‑Site Scripting occurs in the Chat component of Progress Software KendoReact. The flaw permits a low‑privileged attacker who can supply chat messages to craft an unsafe URL within an openUrl quick action. When a user clicks the action, the embedded JavaScript runs in the application’s origin. Based on the description, it is inferred that the script executes with the privileges of the victim user, potentially enabling the attacker to read or alter data that the user can access.

The vulnerability affects Progress Software KendoReact versions 0.6.0 through 16.1.0 in the @progress/kendo-react-conversational-ui package. Clients incorporating any of these versions into web applications are potentially exposed unless mitigated.

The CVSS score of 5.4 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no wide‑scale exploitation has been reported. The likely attack vector involves a low‑privileged user who can submit chat messages containing a crafted URL that triggers JavaScript execution upon the target user’s click. The exploitation requires the application to render the Chat component and the attacker’s message to be seen and interacted with by a user who has at least the ability to click the action. Based on the description, it is inferred that the attacker would need to influence or control the chat content that the victim user views.