XSS Vulnerability in Progress Kendo UI for jQuery Gantt Task Editor
CVE-2026-124691

7.1HIGH

Key Information:

Vendor

Progress Software
Status
Kendo Ui For Jquery
Vendor
CVE Published:
12 November 2026

What is CVE-2026-124691?

The Kendo UI for jQuery Gantt task editor has a vulnerability that allows an attacker to manipulate task titles. When users interact with the dropdown, malicious HTML markup can execute as JavaScript, potentially compromising the user's data integrity and confidentiality. This vulnerability affects versions from 2020.3.915 to 2026.3.1015 and is mitigated in version 2026.4.1111, emphasizing the importance of updating to the latest version to maintain web application security.

Affected Version(s)

Kendo UI for jQuery 2020.3.915 <= 2026.3.1015

References

https://www.telerik.com/kendo-jquery-ui/documentation/kno...
vendor-advisory

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhishek Nandkumar Bhaskar (Abhi-Hackz)
.