Progress Kendo UI for jQuery: Cross-Site Scripting in Gantt Task Editor (CVE-2026-124691)
Progress Kendo UI for jQuery Gantt is vulnerable to a cross-site scripting (XSS) attack via the task editor's Parent dropdown, where unsanitized task titles allow for arbitrary JavaScript execution in the user's browser context.
CVE search metadata
CVE search record: CVE-2026-124691. Severity: high. CVSS: 7.1. KEV: no. Product: Kendo UI for jQuery (< 2026.4.1111). Brief: Progress Kendo UI for jQuery: Cross-Site Scripting in Gantt Task Editor (CVE-2026-124691). Brief link: https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124691/
Triage facts
Revision 1- Applicability
- Kendo UI for jQuery (< 2026.4.1111)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 18:46 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Progress Kendo UI for jQuery Gantt contains a vulnerability where the task editor's Parent dropdown renders task titles as HTML. An attacker capable of influencing a task title displayed in this dropdown can execute arbitrary JavaScript when a user opens or interacts with the task editor.
Impact
Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context.
Recommendation
Users should update to the version of the software in which this issue has been addressed.