CVE-2026-90489
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A vulnerability was identified in Xuxueli xxl-job up to version 3.5.0. Unknown code in /jobinfo/insert mishandles the name/author arguments, leading to cross site scripting (XSS). The attack can be executed remotely and the exploit is publicly available.
Risk Assessment
A remote attacker can inject a malicious script that executes in the user's browser, potentially leading to session or data theft. The public availability of the exploit increases the risk.
Recommendation
Update xxl-job to a version newer than 3.5.0 if available, or implement input validation and sanitization for the name/author fields. Consider deploying CSP headers and WAF rules.
Other vulnerabilities in xxl-job
See all- CVE-2026-94426Low
A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown function of the file /jobgroup/insert. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- CVE-2026-94145Low
A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. It affects unknown code in JobInfoController.java of the Task Management Interface. Manipulation of the argument name/author leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted but did not respond.
- CVE-2026-90488Medium
A vulnerability was determined in Xuxueli xxl-job up to version 3.4.2. The GroovyClassLoader.parseClass function in GlueFactory.java mishandles data, leading to code injection. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-90487Medium
A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobGroupController.java. The manipulation results in improper privilege management. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CVE-2026-52371Medium
xxl-job version 3.4.0 contains an SSRF vulnerability in the xxl-job-admin/jobinfo/trigger component. Authenticated attackers can scan resources via a crafted HTTP request.
- CVE-2026-65316Medium
XXL-Job version 2.4.2 has an insecure direct object reference vulnerability. Authenticated users can read execution logs from unauthorized job groups by supplying sequential log IDs to the logDetailCat endpoint.
- CVE-2023-33779High
A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the /jobinfo/ component.
Original NVD description (English source)
A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name/author leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS