EUVD-2026-84245
GHSA-c8q7-hfwp-8gxx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to xxl-job admin as low-priv user
-
DeliverySubmit /jobgroup/insert with script in Name
-
ExploitPayload stored in job-group record
-
ExecutionVictim admin views job-group list
-
PersistScript executes in admin session
-
ImpactSession hijack or unauthorized admin actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privilege account (PR:L) on the xxl-job admin web console reachable over the network, plus passive interaction (UI:P) by a second victim user who must view the page rendering the malicious job-group Name for the stored script to fire. Limiting factors: it is not unauthenticated (an account or valid session is needed), impact is confined to the victim's browser context (no direct server RCE), and no fixed version is available since the vendor did not respond - defenders must rely on input/output sanitization or WAF mitigation. Affects xxl-job versions up to 3.5.0 per VulDB/CPE. |
| Impact | This is a moderate, not urgent, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) describes a network-reachable but authenticated (PR:L) stored/reflected XSS in the job-group creation form that additionally requires passive victim interaction (UI:P) - a second victim must view the injected job-group Name. Technical impact is narrow: VI:L only (vendor set VC:N/VA:N), meaning session/DOM-level integrity in the victim admin's browser rather than server compromise. The E:P (Proof-of-Concept) exploit maturity aligns with the confirmed public POC on GitHub, but a POC is NOT active exploitation - there is no KEV listing and no EPSS score in the provided data to gauge real-world exploitation probability. The signals are internally consistent (low-to-moderate score, authenticated + UI-gated, limited impact), so this is a genuine-but-low-severity issue rather than a high-CVSS-but-hollow finding. The main caveat: the vendor was contacted but did not respond, so there is NO official advisory or patch, and no fixed version is confirmed. |
| Exploit ScenarioDerived | An attacker with low-privilege authenticated access to the xxl-job admin console submits a new job group via /jobgroup/insert with a JavaScript payload in the Name argument. When another administrator later views the job-group listing, the stored script executes in their authenticated session, enabling actions such as session/cookie theft or CSRF-style admin operations. A public POC exists on GitHub (hhhh333/CVE), lowering the effort to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 21, 2026
Stored cross-site scripting in XXL-JOB up to 3.5.0 allows an authenticated user with permission to manage job groups to inject script through the Name parameter of the /jobgroup/insert endpoint, which then executes in the browser of any admin who views the job-group listing. Publicly available exploit code exists (a GitHub proof-of-concept), but there is no evidence of active exploitation (not in CISA KEV), and no fixed version has been released because the vendor did not respond to coordination attempts. The practical risk is moderate: session or token theft, forced admin actions via the victim's browser, and defacement within the admin console, but no direct server-side code execution.
RemediationAI
No vendor-released patch was identified at the time of analysis, and since the vendor did not respond to disclosure attempts, administrators must rely on compensating controls rather than an upgrade path. The most effective immediate mitigation is server-side input validation plus context-aware output encoding for the job-group Name field so that stored values are rendered as text, not HTML or JavaScript; this requires code changes to the XXL-JOB admin module or a reverse-proxy/WAF rule that inspects and neutralizes script payloads submitted to /jobgroup/insert and returned on job-group listing pages. A WAF can block common XSS patterns with relatively low operational cost but may be bypassed by obfuscated payloads and requires tuning to avoid false positives on legitimate job-group names. Restricting access to the XXL-JOB admin console to trusted management networks or VPNs reduces the exposed attack surface, at the cost of reduced remote administrative convenience. Applying least-privilege account management so that only a small set of trusted users can create or edit job groups limits who can plant a payload, though it does not prevent a compromised low-privilege account from doing so. Monitor logs and database records for suspicious or HTML-bearing job-group names, and consider rotating credentials of any account that may have been exposed to a maliciously crafted job-group page. Authoritative details are available at https://vuldb.com/vuln/408152 and https://vuldb.com/cve/CVE-2026-94426, with the public proof-of-concept at https://github.com/hhhh333/CVE/blob/main/xxl-job-xss%20%204.md serving as a useful test case for validating mitigations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
XXL-JOB is a distributed task-scheduling platform whose Java-based admin web console exposes endpoints such as /jobgroup/insert for creating job groups. The Name argument accepted by that endpoint is persisted and later rendered in the job-group listing without proper output encoding, making it a classic stored cross-site scripting issue in the CWE-79 class. The affected component is identified by the CPE cpe:2.3:a:xuxueli:xxl-job:*:*:*:*:*:*:*:*, which covers all xxl-job releases identified by that vendor prefix, reported up to 3.5.0. The published CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P) confirms network reachability, low attack complexity, a low-privilege authenticated attacker, and passive user interaction, with exploit maturity E:P indicating a proof-of-concept is public; it also notes low integrity impact only and no direct confidentiality or availability impact at the vulnerable component. The independent assessment using CVSS 3.1 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) agrees that authentication is required and adds a scope change plus low confidentiality and integrity impact in the broader victim browser context, consistent with script execution that can read session material or issue authenticated requests on the victim's behalf.
Know when Xxl Job gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Authenticated low-priv attacker (PR:L) stores XSS requiring a victim admin to view it (UI:R); script executes in another user's browser context so S:C with limited C/I and no availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown function of the file /jobgroup/insert. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1. Rated critical severity (CVSS 9.8),
XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks. Rated critical severity (CVSS 9.8), this vulner
A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another use
Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Tas
xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control ex
xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution (RCE) via /xxl-job-admin/jobcode/save. Rated high severity (C
XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController
A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via
Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive infor
A vulnerability, which was classified as problematic, has been found in XXL-JOB 2.3.1. Rated medium severity (CVSS 6.5),
This affects all versions of the package com.xuxueli:xxl-job. Rated medium severity (CVSS 6.1), this vulnerability is re
XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/j
Exploit-DB