Description

A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown function of the file /jobgroup/insert. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-21T23:16:57.917Z",
  "pubdate": "2026-09-21T23:16:57.917Z",
  "executiveSummary": "The vulnerability identified in xuxueli xxl-job up to version 3.5.0 involves a stored Cross-Site Scripting (XSS) flaw within the /jobgroup/insert endpoint. This security defect allows an unauthenticated or authenticated attacker, depending on the instance configuration, to inject malicious client-side scripts into the application via the 'Name' parameter.\nThe vulnerability stems from improper neutralization of input data before it is rendered in the web interface. When an attacker submits a crafted payload, it is stored in the application database and subsequently executed in the context of other users' browsers, including those with administrative privileges. The impact includes session hijacking, unauthorized actions performed on behalf of legitimate users, and the potential exfiltration of sensitive information such as authentication tokens or job configurations. Given the public disclosure of the exploit and the lack of vendor response, there is a significant risk of active exploitation. Organizations utilizing affected versions should treat this as a high-priority risk and implement immediate compensatory controls to restrict access to the management interface.",
  "technicalDetails": "The vulnerability resides in the /jobgroup/insert function, which is responsible for creating new job groups within the xxl-job administration console. The root cause of the issue is the failure to perform adequate input validation and context-aware output encoding on the 'Name' parameter before the data is persisted to the backend database and rendered in the administrative dashboard.\nThe attack flow follows a classic Stored XSS pattern. An attacker initiates the exploitation by sending an HTTP POST request to the /jobgroup/insert endpoint. The 'Name' field is injected with a malicious JavaScript payload, such as a script tag or an event handler (e.g., <script>alert(document.cookie)</script>). Because the application lacks server-side sanitization or validation routines for this input field, the payload is stored directly into the underlying database associated with the job group configuration.\nThe payload remains dormant until a victim, typically an administrator or a privileged user, navigates to the page where job groups are listed or managed. Upon loading the vulnerable view, the application retrieves the malicious entry from the database and injects it into the Document Object Model (DOM) of the victim's browser without proper escaping. When the browser parses the HTML, it treats the stored payload as legitimate script content, executing the malicious code within the security context of the origin where xxl-job is hosted.\nThe execution of this payload allows for several post-exploitation impacts. Since the script executes within the victim's browser session, the attacker can leverage the browser's access to perform actions on behalf of the user, such as creating, deleting, or modifying job schedules, viewing system logs, or accessing sensitive environment variables stored within the job configuration. Furthermore, the script can be configured to exfiltrate session cookies or local storage data to a remote attacker-controlled server, effectively bypassing authentication mechanisms. The vulnerability is network-accessible and can be initiated remotely, making it a critical threat to instances exposed to untrusted networks. The exploit is currently public, significantly lowering the barrier to entry for potential attackers looking to compromise the management interface of the xxl-job orchestration system."
}