CVE-2026-106706: XXL-JOB Stored XSS Vulnerability

CVE-2026-106706 Overview

CVE-2026-106706 is a stored cross-site scripting (XSS) vulnerability in XXL-JOB through version 3.5.0-SNAPSHOT. The flaw resides in the GLUE code editor, where the JobCodeController.save() method persists the user-supplied glueSource parameter without output encoding. The FreeMarker template job.code.ftl then renders the stored value unescaped, allowing attacker-controlled script to execute in the browser of any user viewing the job code. Exploitation requires authenticated access to create or modify jobs and relies on another user interacting with the affected page. The issue is tracked under CWE-79.

Critical Impact

Authenticated attackers can inject persistent JavaScript into the job scheduler console, hijacking sessions of administrators who view the compromised GLUE job.

Affected Products

• XXL-JOB versions up to and including 3.5.0-SNAPSHOT
• Deployments exposing the admin console (xxl-job-admin) to multiple users
• Instances using the GLUE code editor for job script management

Discovery Timeline

• 2026-10-15 - CVE-2026-106706 published to the National Vulnerability Database
• 2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-106706

Vulnerability Analysis

XXL-JOB is a distributed task scheduling platform widely deployed in Java environments. The GLUE feature allows users to author inline job code through the admin console. When a user saves a job script, the controller method JobCodeController.save() writes the raw glueSource value to persistent storage without applying HTML or JavaScript output encoding.

When another operator opens the job for review, the admin console renders the stored content through the FreeMarker template job.code.ftl. The template emits the value directly into the page without escaping, so any HTML or <script> content supplied earlier executes in the viewer's browser session.

Because the payload persists in the job definition, it fires every time the record is loaded. A low-privileged job author can therefore target administrators, exfiltrate session cookies, perform actions in the admin UI, or pivot to other scheduler APIs.

Root Cause

The root cause is missing output encoding at the template layer combined with absent server-side sanitization in JobCodeController.save(). FreeMarker does not auto-escape values in job.code.ftl, so attacker-controlled markup is treated as trusted HTML.

Attack Vector

An authenticated user with permission to edit GLUE jobs submits a glueSource payload containing JavaScript. The admin console stores the payload verbatim. When a victim with higher privileges opens the job view, the browser executes the injected script in the context of the XXL-JOB admin origin. Refer to the CVE-2026-106706 submission and the XXL-JOB repository for implementation specifics.

Detection Methods for CVE-2026-106706

Indicators of Compromise

• GLUE job records whose glueSource field contains HTML tags such as <script>, <img onerror=...>, or <svg> payloads.
• Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after opening a job detail page.
• Audit log entries showing job edits from low-privileged accounts followed by administrator views of the same job.

Detection Strategies

• Scan the XXL-JOB database table storing job source code for markup tokens and event handler attributes.
• Instrument the admin console with Content Security Policy violation reporting to surface inline script execution.
• Review web server access logs for POST requests to /jobcode/save containing encoded <, >, or javascript: sequences in glueSource.

Monitoring Recommendations

• Alert on administrator session activity originating from new IP addresses or user agents following a GLUE job view.
• Correlate authentication logs, job modification events, and outbound browser traffic to identify session hijack patterns.
• Track changes to job definitions over time and flag edits that introduce HTML syntax into script fields.

How to Mitigate CVE-2026-106706

Immediate Actions Required

• Restrict GLUE job edit permissions to a minimal set of trusted operators until a fix is applied.
• Audit existing job records for stored HTML or script payloads and remove suspicious content.
• Place the xxl-job-admin console behind an authenticated reverse proxy and block direct exposure to untrusted networks.

Patch Information

At publication, no fixed release is listed in the NVD advisory. Monitor the XXL-JOB GitHub repository for a release that enables FreeMarker auto-escaping on job.code.ftl and adds server-side sanitization in JobCodeController.save().

Workarounds

• Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources on the admin console.
• Apply a reverse-proxy filter that strips HTML tags from glueSource parameters on POST /jobcode/save requests.
• Separate job authoring and job approval duties so administrators do not open untrusted job views directly.

# Example nginx CSP header for the xxl-job-admin console
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;