Hi Joao,

Thank you for the report and for the clear comparison between the versions. We prepared a project ad confirmed the behavior.

What changed. Starting with 2026.3.1001, the Editor sanitizes pasted HTML more strictly as part of security hardening against XSS. As a side effect, the src of an <img> with a data:image/...;base64 source is removed when the HTML is pasted. Pasting an image file directly from the desktop is not affected. Version 2026.3.811 predates this change.

Fix. We have a fix that keeps src for raster base64 images (bmp, gif, jpeg, png and webp) on <img> elements. The fix is currently under review.

Workaround until then. Handle the Editor's paste event. It runs before the sanitization, so the data URL can be moved to a temporary attribute and restored afterwards:

$("#editor").kendoEditor({
    paste: function(e) {
        var editor = this;
        e.html = e.html.replace(
            /(<img[^>]*?\s)src=(["'])(data:image\/(?:bmp|gif|jpeg|png|webp);base64,[^"']+)\2/gi,
            "$1data-pasted-src=$2$3$2"
        );
        setTimeout(function() {
            editor.body.querySelectorAll("img[data-pasted-src]").forEach(function(img) {
                img.setAttribute("src", img.getAttribute("data-pasted-src"));
                img.removeAttribute("data-pasted-src");
            });
        });
    }
});

The workaround, also shown in this dojo, allows only raster images, the same as the fix. We recommend using it only if the pasted content comes from a trusted source, and removing it after you upgrade to the version with the fix.

As a small token of gratitude for your bug report, I updated your Telerik points.

Regards,
Rumen
Progress Telerik