CVE-2026-124691 · Package
NO FIX YET · SEE WHAT TO DO
The Parent dropdown in the Gantt task editor renders task titles as raw HTML instead of text. An attacker who can set a task title can make script run in the browser of a user who opens the task editor, exposing data in that browser session.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use the Kendo UI for jQuery Gantt widget with its task editor, where users or other parties can influence task titles. Versions from 2020.3.915 through 2026.3.1015 are vulnerable. Apps that do not use the Gantt widget are not exposed.
Not affected if no-gantt-widget, titles-not-user-controlled
Who cares frontend, gantt, jquery, kendo-ui
npm ls @progress/kendo-ui or npm ls @progress/kendo-ui-for-jquery.2026.4.1111 or later.In Progress Kendo UI for jQuery Gantt, the task editor's Parent dropdown renders task titles as HTML. An attacker who can influence a task title shown in the dropdown can cause attacker-controlled markup to execute as JavaScript when a user opens or interacts with the task editor. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2020.3.915; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.