CVE-2026-39400
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Cronicle, a multi-server task scheduler, prior to version 0.9.111 allows non-admin users to inject arbitrary JavaScript through job output fields. The server stores data without sanitization, and the client renders it via innerHTML on the Job Details page.
Risk Assessment
An attacker can execute scripts in other users' browsers, potentially leading to session theft or unauthorized actions.
Recommendation
Update Cronicle to version 0.9.111 or later, which includes the fix.
Original NVD description (English source)
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, a non-admin user with create_events and run_events privileges can inject arbitrary JavaScript through job output fields (html.content, html.title, table.header, table.rows, table.caption). The server stores this data without sanitization, and the client renders it via innerHTML on the Job Details page. This vulnerability is fixed in 0.9.111.