The Editor component in Kendo UI for Angular allows an attacker with low privileges to insert malicious content containing unsafe URLs. When a user opens the editor, the content is rendered without proper sanitization, enabling arbitrary JavaScript to execute in the user's browser. This can lead to session hijacking, credential theft, or the spread of malicious code within the application.

Progress Software’s Kendo UI for Angular – Editor component (@progress/kendo-angular-editor) – versions earlier than 25.3.0 are affected. Any application using this library and accepting user‑generated content is impacted.

The CVSS score is 5.4, indicating moderate severity, and the EPSS score is not available. The vulnerability is not listed in CISA KEV. Attackers can exploit the flaw by embedding a link or image with an unsafe URL in the editor content; when another user interacts with the editor, the script runs. The requirement for user interaction slightly increases the exploitation threshold, but the low‑privileged attacker only needs to supply the content, making the risk moderate.