XXL-JOB CVE-2026-106707

Exploitation requires an authenticated XXL-JOB account that holds trigger permission on a target executor job group (per CVSS PR:L); it is not available to anonymous or unprivileged users. The attacker injects JavaScript through the executorParam argument of the manual-trigger endpoint POST /jobinfo/trigger, and the payload only fires when a victim user loads the /joblog job log list page (UI:R) - so a second, typically higher-privileged operator/admin must actually view that page for impact to occur. Limiting factors: prior valid credentials with the specific group permission, required victim interaction (viewing the log page), and applicability only to XXL-JOB builds at or below 3.5.0-SNAPSHOT. Internet-exposed or multi-tenant admin consoles raise realistic risk; isolated single-operator deployments lower it.

This is a moderate-severity, authenticated stored XSS (CVSS 5.4) that should be treated as a real but second-tier priority rather than an urgent, drop-everything issue. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) tells a consistent story: network-reachable and low-complexity, but gated by authentication (PR:L) and requiring a victim to view the malicious job-log page (UI:R), with scope change (S:C) reflecting that the injected script executes in another user's browser/session. Impact is limited (C:L/I:L, A:N) - session/credential theft or UI-level action forgery against an operator, not direct server compromise. No EPSS score, no CISA KEV listing, and no SSVC decision data were provided, and no public exploit code is referenced, so there is no evidence of active exploitation - the two references are only the upstream project repo and a CVE-request writeup. The main caveat: an attacker already needs an authenticated account with trigger permission on an executor job group, which meaningfully narrows the threat to insiders or attackers who have already obtained valid low-privilege credentials, and the most valuable victim (an admin reviewing logs) must actually open the affected page. Treat as a privilege-escalation-flavored XSS against operators; patch in normal cycle, prioritize if XXL-JOB consoles are internet-exposed or shared across trust boundaries.

A low-privileged but authenticated XXL-JOB user who holds trigger permission on an executor job group submits POST /jobinfo/trigger with a malicious JavaScript payload in the executorParam field. The payload is stored and later rendered when an administrator or another operator opens the /joblog job-log list page, executing in their session to steal cookies or perform actions as that higher-privileged user. No public proof-of-concept is referenced, so exploitation would require an attacker to craft the payload themselves.