The Editor component (@progress/kendo-react-editor) in Progress Software KendoReact contains an XSS flaw (CWE‑79) that allows an attacker who can supply Editor content to embed an unsafe URL. When a user clicks the link, the embedded JavaScript executes in the victim’s browser, enabling arbitrary code execution such as cookie theft, session hijacking, or CSRF attacks. The vulnerability requires only that the attacker can insert content into the Editor; no privileged access is needed to exploit it.

The flaw affects all versions of the KendoReact Editor component from 2.7.0 through 16.1.0. The vendor is Progress Software. No specific build or configuration is mentioned beyond the version range.

The CVSS score of 5.4 classifies this as a moderate severity issue, and the EPSS score is currently unavailable, but the absence of a KEV listing suggests limited evidence of widespread exploitation. The attack path requires an attacker to supply malicious Editor content that a victim later views and interacts with; thus the primary vector is user interaction with a crafted link. Because XSS can spread within a browser, the potential impact is for the end user’s session and data, but it does not provide a broader system compromise.