Description

A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Management Interface. The manipulation of the argument name/author leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-21T07:16:53.810Z",
  "pubdate": "2026-09-21T07:16:53.810Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the Task Management Interface of xxl-job versions up to 3.4.2 and 3.5.0.\nThe vulnerability allows remote, unauthenticated or authenticated attackers to inject malicious JavaScript into the application via specific input parameters.\nThe flaw resides in the handling of 'name' and 'author' parameters within the JobInfoController.java component, which fails to properly sanitize user-supplied data before rendering it in the browser.\nSuccessful exploitation results in the execution of arbitrary scripts in the context of the victim's session, potentially leading to unauthorized actions, session hijacking, or the theft of sensitive session cookies.\nGiven the nature of the application as a task orchestration tool, this could allow attackers to manipulate scheduled jobs or gain administrative control over the task management dashboard.\nThe vulnerability is publicly disclosed, and given the lack of vendor response, organizations should implement manual sanitization or input validation controls immediately.",
  "technicalDetails": "The vulnerability is a classic Stored Cross-Site Scripting (XSS) flaw located in the xxl-job-admin component. Specifically, the vulnerability manifests within the 'JobInfoController.java' file, which manages task metadata registration and updates.\nThe root cause is the improper sanitization and encoding of user-supplied input provided via the 'name' and 'author' parameters during the job creation or modification process. The application accepts these strings and persists them directly into the database without validating the content for executable markup or escaping it upon rendering.\nWhen a user or administrator accesses the Task Management Interface, the web application retrieves the stored job metadata from the backend database and reflects the unsanitized values back into the HTML response. If an attacker submits a payload containing crafted HTML or script tags (e.g., <script>alert(document.cookie)</script>), the browser will interpret and execute the script within the context of the origin domain.\nThe exploitation flow follows these steps: 1) The attacker crafts a malicious request targeting the JobInfoController endpoints, embedding a JavaScript payload in the 'name' or 'author' fields. 2) The server processes the request and persists the malicious payload into the application database. 3) A legitimate user or administrator navigates to the Task Management dashboard where the affected entries are displayed. 4) The application renders the stored job metadata in the browser. 5) The browser executes the injected script with the privileges of the victim's session.\nThis vulnerability is remotely exploitable, requiring only access to the Task Management interface. While the specific authentication requirements depend on the implementation of the admin console, the impact is significant as it allows for the exfiltration of session identifiers, execution of unintended administrative commands, or redirection of users to malicious sites.\nAffected versions include all iterations up to 3.4.2 and 3.5.0. Because the application logic fails to implement context-aware output encoding (such as converting special characters into HTML entities), any user with permission to modify job attributes can successfully leverage this vulnerability to compromise the integrity and confidentiality of the administrative interface."
}