XXL-JOB CVE-2026-94145

Requires an authenticated account with access to the xxl-job admin Task Management interface (JobInfoController job create/edit) to inject the payload into the 'name' or 'author' argument (PR:L). Exploitation further requires victim user interaction (UI:P/UI:R): a second operator or administrator must load the job list/detail page for the stored script to execute. Limiting factors: the admin console is typically internal/not internet-exposed, self-XSS by the injecting account is meaningless, and impact is confined to integrity of the browser session (no direct server compromise). Applies to xxl-job versions up to 3.4.2/3.5.0.

This is a low-real-risk issue despite being publicly disclosed with PoC. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N) and the vendor's 2.0 score correctly capture a minor stored/reflected XSS in an authenticated admin-only interface: an attacker must already hold valid xxl-job credentials with job-management access (PR:L) AND a second user must view the malicious job entry (UI:P/UI:R). Exploitation status: publicly available exploit code exists (PoC on GitHub, hhhh333/CVE) but there is NO CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. SSVC-wise this is not automatable and technical impact is partial (integrity-only, VI:L). The main disputable point: VulDB rated confidentiality VC:N, but stored XSS executing in an authenticated admin's browser can realistically enable session/CSRF-token theft, so a modest C:L is defensible - this would raise the real severity slightly above the vendor's 2.0. Bottom line: genuine but low priority; patch on a normal cycle, prioritize behind unauthenticated or higher-impact findings. Note the vendor did not respond to the disclosure, so no official fix version is confirmed.

An authenticated user with access to the xxl-job admin Task Management interface creates or edits a scheduled job, injecting a JavaScript payload into the job 'name' or 'author' field. When another operator or administrator opens the job list/detail view, the script executes in their browser session, enabling session hijacking or actions performed as the victim. A public PoC demonstrating the injection exists on GitHub.