Kendo UI for jQuery: XSS in the Gantt Parent dropdown (CVE-2026-124691)

A Kendo Gantt task title can execute script when another user opens the task editor’s Parent dropdown. Update the widget to protect users who interact with attacker-influenced tasks.

Public CVE record · Vendor or publisher advisory · Native module source

CVE advisory record · Vendor advisory · Module source

Result. The marked request reached the backend in the baseline and raised its counter. The native rule refused that request with HTTP 403 and preserved HTTP 200 for the benign probe. The synthetic fixture ran through Eden 1.103.0 on November 12, 2026 (UTC).

The vulnerability

The Gantt task editor builds the Parent dropdown from existing task titles. In affected builds, a title supplied by someone who can edit a task is rendered as markup when another user opens the parent selector. The action that introduces the title and the action that renders it can occur in different sessions.

Progress lists affected builds from 2020.3.915 through 2026.3.1015. The fix is in 2026.4.1111. The CVE record reports a CVSS base score of 7.1.

The Eden patch

Tier 1 — declarative policy. The recorded policy denies requests to /kendo-ui/gantt and its descendants. The empty method list leaves the deny unrestricted by HTTP method. This is a coarse rule and blocked the benign probe on the same path.

{
  "version": 1,
  "profile": "http-structure-v1",
  "policy": {
    "version": 1,
    "rules": [
      {
        "scope": {
          "methods": [],
          "path": "/kendo-ui/gantt",
          "descendants": true
        },
        "require": {
          "kind": "deny"
        }
      }
    ]
  }
}

Tier 2 — native Rust module. gabriel_kendogantt_v1 waits for the request to be complete, checks whether the request target starts with /kendo-ui/gantt, and looks for any configured marker in the body. The substring comparison is ASCII case-insensitive. Outside that prefix or without a marker, the module returns Continue. The shown lines are excerpts from the linked source.

const ROUTE: &[u8] = b"/kendo-ui/gantt";
static NEEDLES: [&[u8]; 2] = [b"<script", b"onerror="];

NEEDLES.iter().any(|n| find_ignore_case(body, n).is_some()) && return Ok(Decision::Refuse);

Implement the remediation

The commands are operator examples for the recorded scope. Compare fixture routes and software selectors with the intended deployment before use. See deployment prerequisites.

1. Prepare the target. Verify the loaded product and version against the advisory. Use a compatible Eden HTTP interlay and an authenticated operator with Configure permission. Use the recorded declaration and the linked source when applicable.
2. Apply the declarative policy. Scope the policy to /kendo-ui/gantt and descendants (all methods, deny). Set INTERLAY to the target interlay UUID in the authenticated Eden CLI. Run an authenticated GET /api/v1/interlays/{interlay} with X-Eden-Verbose: true. Save its complete current settings object as current-settings.json and retain the prior remediation declaration for recovery. Set IDEMPOTENCY_KEY to a fresh key for this intended mutation.

Save the JSON in the patch section as remediation.json.

jq -e --slurpfile policy remediation.json \
  '.remediation = $policy[0] | {settings: .}' current-settings.json \
  > interlay-update.json
eden api request PATCH "/api/v1/interlays/$INTERLAY" \
  --header "Idempotency-Key:$IDEMPOTENCY_KEY" \
  --body-file interlay-update.json --content-type application/json --confirm

3. Verify the serving policy. Read back the interlay.

eden api request GET "/api/v1/interlays/$INTERLAY" \
  --header 'X-Eden-Verbose:true'

Check that remediation_status.state is ready and both desired and effective SHA-256 values match the intended declaration. Replay the benign and marked requests in the recorded comparison on an isolated target. Check the recorded response and backend outcome for each probe. 4. Restore the previous policy. Coordinate the change with any other operator updating this interlay. Read current settings again and merge the saved remediation field into them. If the prior settings had no remediation field, omit it in the replacement. Send the same PATCH with a fresh idempotency key, then read back the intended state. Repeat the verification probes. Keep the affected route isolated if restoring the prior settings reopens exposure.

Native module gabriel_kendogantt_v1

1. Prepare the archive. Use the linked source and a compatible Eden SDK. Obtain the built archive and manifest from a qualified Eden build environment. Configure independent host approval for the installed Eden release. Use the authenticated principals required by the native authority contract. Set PATCH_ARCHIVE to the exact schema-2 package and PACKAGE_SHA256 to its expected archive digest. Verify and import it using the same target interlay.

printf '%s  %s\n' "$PACKAGE_SHA256" "$PATCH_ARCHIVE" | sha256sum --check &&
  eden api request PUT "/api/v1/interlays/$INTERLAY/patch-packages/$PACKAGE_SHA256" \
    --body-file "$PATCH_ARCHIVE" \
    --content-type application/vnd.eden.patch-package.v2+tar --confirm

2. Approve and activate. Enroll the publisher key, attest host software inventory, and inspect the configuration returned by import. Obtain independent host approval. Sign the typed statement with the matching SDK. Send the admit action followed by activate for the prepared operation. Use the applicable typed payload for each action in authority-action.json.

eden api request POST "/api/v1/interlays/$INTERLAY/native-authority" \
  --body-file authority-action.json --content-type application/json --confirm

3. Verify the operation. Read the receipt through the same endpoint. Confirm serving_now and the full expected shard acknowledgment. Repeat the report’s benign and marked probes and check the backend observations.
4. Revoke or restore. Send revoke with the exact operation UUID. Mandatory protection can refuse traffic until a compatible operation is approved and activated. Verify the restored receipt and repeat the probes.

Vendor update. Use the advisory to select the fixed release for the installed branch. Reported fixed releases include 2026.4.1111. Follow the vendor’s update instructions and confirm the version actually loaded by the service.

Fixture and probes

The fixture was a synthetic HTTP handler behind Eden. It answered the probes and kept a separate counter that increased when the handler recognized its marker bytes. The counter measures a fixture effect. An HTTP 200 from the baseline does not by itself establish that the counter moved.

Request. POST /kendo-ui/gantt/save for the benign probe and the marked probe.

The benign request saved a task named t1. The second request carried a script marker in the task value plus an event-handler marker in another field. The synthetic backend incremented its counter when those bytes reached it.

Measured comparison (2026-11-12 UTC)

The values after each status are the observed increases in the backend marker counter.

Request latency

Eden telemetry request spans measured in the fixture. Latencies are in microseconds (µs).

These are durations of the recorded request spans. The passing request includes the path to the fixture, while the policy and native refusal rows describe requests that ended at Eden. The rows represent different request outcomes, so their difference does not isolate module CPU time. The sample counts are shown for each arm.

Signed module authority

The module import returned HTTP 201 and required explicit activation. Signature verification was deferred at import. Read-only inspection returned HTTP 403, admission with a tampered statement returned HTTP 400, and admission with an invalid signature returned HTTP 403. The activation receipt reported the module serving on all expected shards.

After revocation, the same marked request received HTTP 503. Re-approval and reactivation restored HTTP 403. The source digest below identifies the linked Rust file. The binary digest identifies the artifact recorded in the activation evidence.

• Source SHA-256 bdadf1d9aec2ac7e5dc1fa0d2cc515d6a0614b6d2866d1a1f938cd273d43f2a3
• Tested binary SHA-256 b9064436e97d6316eb8f42b413065700399e8c90f6df005806ca0135ebc44a0b

Test scope

The filter scans the whole request body. A markup fragment in an unrelated field can also trigger a refusal, and ordinary task metadata may carry text that looks like markup. The experiment did not open the Gantt editor or verify its dropdown rendering. The route applies only where the integration sends these values through Eden.

Evidence and artifacts

• Public CVE record
• Vendor or publisher advisory
• Published module source