Threats tagged 'ghsa-38f5-57r3-974w'

A Cross-Site Scripting (XSS) vulnerability exists in the Editor component (@progress/kendo-vue-editor) of Progress Software Kendo UI for Vue versions 2.7.1 through 10.0.0. This flaw allows a low-privileged attacker who can supply content to the Editor to execute arbitrary JavaScript in another user's browser by entering an unsafe URL in the Insert Link or Insert Image dialog. The malicious script executes when the user clicks the resulting link.