Description

A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name/author leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-13T00:17:06.853Z",
  "pubdate": "2026-09-13T00:17:06.853Z",
  "executiveSummary": "A Stored Cross-Site Scripting (XSS) vulnerability exists in Xuxueli xxl-job versions up to 3.5.0, specifically within the /jobinfo/insert endpoint.\nThis vulnerability allows a remote, unauthenticated or authenticated attacker to inject malicious JavaScript payloads into the system by manipulating the 'name' or 'author' parameters.\nWhen a user or administrator interacts with the affected job management interface, the injected script executes within the context of the victim's browser session.\nThe risk implication is significant, as successful exploitation can lead to session hijacking, unauthorized actions performed on behalf of the administrator, or sensitive data exfiltration.\nGiven that the exploit code is publicly available, the system is exposed to immediate risks from automated or manual exploitation attempts.\nAs the vendor has not responded to disclosure, users are advised to apply manual mitigations to secure their deployments.",
  "technicalDetails": "The vulnerability is located in the /jobinfo/insert endpoint of the xxl-job application, which handles the submission of job configurations.\nThe root cause is improper input validation and output encoding of user-supplied data provided via the 'name' and 'author' parameters before these values are persisted in the application's backend database and subsequently rendered in the web management interface.\nThe exploitation flow begins when an attacker crafts a malicious request containing a script tag or event handler (e.g., <script>alert(1)</script>) within the 'name' or 'author' fields during the job creation process.\nThe application processes this request and stores the unsanitized input as part of the job metadata.\nWhen an administrator navigates to the job management console to view or edit existing jobs, the application retrieves the malicious string from the database and embeds it directly into the HTML document structure of the administrative panel without applying adequate context-aware encoding.\nThe victim's browser interprets the malicious content as executable JavaScript rather than plain text, triggering the script execution in the context of the current session.\nThis constitutes a stored (persistent) XSS attack, meaning the payload is executed every time a victim views the affected job information.\nThe impact includes the potential to bypass Same-Origin Policy protections to access sensitive cookies, session tokens, or other localStorage data associated with the xxl-job administrative console.\nAn attacker can leverage this execution to perform unauthorized state-changing operations, such as modifying other job configurations, creating new malicious tasks, or triggering remote code execution if other system vulnerabilities are chained with the XSS.\nThe vulnerability is remotely exploitable, requiring no specific privileges if the job insertion endpoint is exposed to the network, and the exploit is currently publicly documented, increasing the likelihood of opportunistic exploitation attempts."
}