CVE-2026-124691

Progress Kendo UI for jQuery cross-site scripting (XSS) in Gantt parent dropdown

high · 7.1

Fix listed

Progress Kendo UI for jQuery

Published Nov 12, 2026, 16:42 UTC

Description

In Progress Kendo UI for jQuery Gantt, the task editor's Parent dropdown renders task titles as HTML. An attacker who can influence a task title shown in the dropdown can cause attacker-controlled markup to execute as JavaScript when a user opens or interacts with the task editor. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2020.3.915; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.

Reported fixed versions

2026.4.1111

Official CVE record Read Eden case study View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.