Cross-Site Scripting in the Kendo UI for jQuery Gantt Parent Dropdown (CVE-2026-124691)
Description
November 2026 - CVE-2026-124691
What Are the Impacts
An attacker who can influence a task title shown in the Parent dropdown can cause attacker-controlled markup to execute as JavaScript when a user opens or interacts with the task editor. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context.
Is My Application Vulnerable?
Your application may be vulnerable if it uses an affected version and allows an attacker to control task titles shown in the Gantt task editor's Parent dropdown.
Issue
- CWE classification: CWE-79, Improper Neutralization of Input During Web Page Generation (Cross-site Scripting).
- CAPEC classification: CAPEC-63, Cross-Site Scripting (XSS).
Solution
We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.
| Current Version | Update to |
|---|---|
| Affected version range not established | >= 2026.4.1111 |
Follow the Kendo UI for jQuery update instructions. Licensed customers can access Product Downloads | Your Account.
Notes
- If you have questions about this issue, open a Technical Support case in Your Account | Support Center.
- We would like to thank Abhishek Nandkumar Bhaskar (Abhi-Hackz) for their responsible disclosure and cooperation.
External References
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N (4.7).
In Progress Kendo UI for jQuery Gantt, the task editor's Parent dropdown renders task titles as HTML. An attacker who can influence a task title shown in the dropdown can cause attacker-controlled markup to execute as JavaScript when a user opens or interacts with the task editor. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established; the issue is fixed in version 2026.4.1111.
Finder Credit: Abhishek Nandkumar Bhaskar (Abhi-Hackz)