CVE-2026-124691: Cross-Site Scripting in Kendo UI for jQuery Gantt Parent Dropdown
In Progress Kendo UI for jQuery Gantt, the task editor's Parent dropdown renders task titles as HTML. An attacker who can influence a task title shown in the dropdown can cause attacker-controlled markup to execute as JavaScript when a user opens or interacts with the task editor. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2020.3.915; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kendo UI for jQuery Ganttto a version that resolves this vulnerability.Fixed in 2026.4.1111
Event History
Frequently Asked Questions
Which deployments are affected?
Kendo UI for jQuery Gantt versions from 2020.3.915 through 2026.3.1015 are affected. Version 2026.4.1111 fixes the issue.
What must an attacker be able to do to exploit this issue?
An attacker must be able to influence a task title that appears in the task editor's Parent dropdown. Exploitation also requires a user to open or interact with the task editor.
Who is exposed when malicious task titles are present?
Users who open or interact with the Gantt task editor can execute the attacker-controlled markup in their browser context. The potential impact includes compromise of confidentiality and integrity of data available to that user’s browser session.