Description

A vulnerability was determined in Xuxueli xxl-job up to 3.4.2. This affects the function GroovyClassLoader.parseClass of the file xxl-job-core/src/main/java/com/xxl/job/core/glue/GlueFactory.java. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-13T00:17:06.680Z",
  "pubdate": "2026-09-13T00:17:06.680Z",
  "executiveSummary": "A critical code injection vulnerability exists in the xxl-job framework up to version 3.4.2.\nThe vulnerability originates from the insecure handling of dynamic code execution within the GLUE (Groovy Logic Universal Execution) component.\nBy manipulating the inputs processed by the GroovyClassLoader.parseClass function, a remote, unauthenticated attacker can achieve arbitrary code execution on the target server.\nThis flaw allows full system compromise, enabling attackers to execute system commands, access sensitive data, or establish persistence within the host infrastructure.\nGiven that the exploit is publicly disclosed and no response has been provided by the vendor, the risk of exploitation is high for organizations running vulnerable versions of the framework.\nImmediate mitigation is required to prevent unauthorized system access through this attack vector.",
  "technicalDetails": "The vulnerability is rooted in the implementation of the GLUE feature within the XXL-JOB framework, specifically located in the file xxl-job-core/src/main/java/com/xxl/job/core/glue/GlueFactory.java.\nThe function GroovyClassLoader.parseClass is utilized to dynamically compile and load Groovy scripts, which are intended to provide flexible job logic for the executor.\nThe vulnerability arises because the application fails to adequately sanitize or restrict the content of the Groovy source code before it is passed to the GroovyClassLoader for parsing and instantiation.\nAn attacker can leverage this by sending a crafted request to the executor that includes malicious Groovy code. When the GLUE engine processes this request, it triggers the compilation of the payload.\nBecause the Groovy runtime is inherently powerful, an attacker can instantiate Java objects, invoke system-level APIs, and execute shell commands directly under the security context of the Java process running the xxl-job-core component.\nThe attack flow follows these steps: first, the attacker identifies a reachable xxl-job executor. Second, the attacker submits a malicious payload disguised as a job script, targeting the functionality governed by GlueFactory. Third, the application's underlying Groovy environment invokes parseClass on the attacker-supplied payload. Fourth, the Java Virtual Machine executes the bytecode generated from the malicious script, granting the attacker arbitrary code execution capabilities.\nThe exploitation is remote and does not require pre-existing authentication, making it a severe security threat. Post-exploitation, the attacker operates with the same privileges as the user running the XXL-JOB executor process, which typically includes read/write access to the host filesystem, network reconnaissance capabilities, and the ability to interact with other internal services.\nThis vulnerability highlights the dangers of deserialization and dynamic code compilation patterns when the input source is not strictly validated or isolated within a hardened sandbox environment."
}