The vulnerability is a cross-site scripting flaw in the Kendo UI Vue editor component. An attacker who can supply content via the Insert Link or Insert Image dialog can embed a malicious URL that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser. The injected script runs with the privileges of the page and could exfiltrate data, modify the DOM, or perform further attacks. The weakness is classified as CWE-79.

This issue affects Progress Software Kendo UI for Vue component @progress/kendo-vue-editor versions 2.7.1 through 10.0.0. Any deployment that includes this editor and allows users to input link or image URLs without proper sanitization is vulnerable.

With a CVSS score of 5.4 the flaw is moderate. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, indicating no known widespread exploitation yet. The likely attack vector is through user-supplied content that is later presented to other users; a low‑privileged attacker who can input content into the editor can deliver the malicious link. Because the malicious code only runs when a user clicks the link, the risk depends on user interaction but still allows full XSS in the victim’s context.