Telerik and Kendo UI Products PdfViewer Component Cross-Site Scripting Vulnerability

A Cross-Site Scripting (XSS) vulnerability has been identified in the PdfViewer component of various Telerik and Kendo UI products, including ASP.NET Core, ASP.NET MVC, Blazor, Angular, jQuery, and React. This vulnerability affects specific versions of these products and can be exploited if a specially-crafted document is loaded and the user interacts with a tool that requires the DOM to be re-rendered.

Impact

Exploitation of this vulnerability allows for Cross-Site Scripting (XSS) attacks, where an attacker can execute arbitrary JavaScript in the context of the user's session. This could lead to data theft or other malicious actions.

Remediation

Users are advised to upgrade to the latest version of the Telerik or Kendo UI product they are using. Specific version recommendations vary by product: For ASP.NET Core and MVC, upgrade to version 2025.2.702 or later. For Kendo UI for Angular, upgrade to version 19.2.0 or later. For Kendo UI for jQuery, also upgrade to version 2025.2.702 or later. For KendoReact, upgrade to version 11.2.0 or later.