CVE-2026-26719

MediumCVSS 6.1

Published: 15/07/2026(UTC)Updated: 16/07/2026(UTC)Translated: 17/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

28th percentile - higher than 28% of all known CVEs

Summary

A Cross Site Scripting (XSS) vulnerability has been discovered in xxl-job-admin version 3.0.0. A remote attacker can exploit a crafted HTTP GET request containing a malicious script to execute arbitrary code in the victim's browser context.

Risk Assessment

The risk involves potential session theft, administrator account takeover, or unauthorized operations in the xxl-job admin panel. This could lead to data confidentiality and integrity breaches as well as disruption of job scheduling.

Recommendation

Immediately update xxl-job-admin to the latest available version that includes a fix for the XSS vulnerability. Until the update is applied, restrict access to the admin panel and implement input validation and sanitization for HTTP GET requests.

Other vulnerabilities in xxl-job-admin

CVE-2026-26718Critical
A Cross-Site Request Forgery (CSRF) vulnerability was found in xxl-job-admin web application version 3.0.0. The lack of CSRF token validation and acceptance of arbitrary HTTP methods in the endpoint allow an attacker to make unauthorized modifications to Glue IDE shell scripts.

Original NVD description (English source)

Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request containing a malicious script