CVE-2026-39400: Cronicle Task Scheduler XSS Vulnerability

CVE-2026-39400 Overview

CVE-2026-39400 is a Stored Cross-Site Scripting (XSS) vulnerability in Cronicle, a multi-server task scheduler and runner with a web-based front-end UI. Prior to version 0.9.111, non-admin users with create_events and run_events privileges can inject arbitrary JavaScript through job output fields including html.content, html.title, table.header, table.rows, and table.caption. The server stores this malicious data without proper sanitization, and the client renders it via innerHTML on the Job Details page, enabling persistent XSS attacks.

Critical Impact

Attackers with limited privileges can execute arbitrary JavaScript in the browsers of other users viewing job details, potentially leading to session hijacking, credential theft, or further privilege escalation within the Cronicle application.

Affected Products

• Cronicle versions prior to 0.9.111

Discovery Timeline

• 2026-04-07 - CVE CVE-2026-39400 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-39400

Vulnerability Analysis

This vulnerability exists in Cronicle's job output rendering mechanism. When a job completes execution, its output data is stored on the server and later displayed on the Job Details page in the web UI. The application fails to sanitize user-controlled content in several output fields before storing them, and subsequently renders this data using the browser's innerHTML property without encoding.

The affected fields include structured output elements such as html.content, html.title, table.header, table.rows, and table.caption. Since these fields accept arbitrary content from job execution results, a user with create_events and run_events privileges can craft a malicious job that injects JavaScript payloads into these fields. When another user (including administrators) views the job details page, the malicious script executes in their browser context.

Root Cause

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The vulnerability stems from two critical security failures:

1. Missing Server-Side Sanitization: The server accepts and stores arbitrary content in job output fields without filtering or encoding potentially dangerous HTML and JavaScript.

2. Unsafe Client-Side Rendering: The web UI uses innerHTML to render job output content directly into the DOM, executing any embedded scripts or event handlers.

Attack Vector

The attack is network-accessible and requires low privileges (a valid user account with create_events and run_events permissions). An attacker would:

1. Create a scheduled job or event within Cronicle
2. Configure the job to output malicious JavaScript within supported output fields (e.g., embedding <script> tags or event handlers in html.content)
3. Execute the job to store the malicious payload on the server
4. Wait for victim users to view the job details page, triggering script execution

The vulnerability mechanism leverages innerHTML rendering without sanitization. When a victim navigates to the Job Details page containing the malicious job output, the browser parses the stored HTML content and executes any embedded JavaScript. This could be used to steal session cookies, perform actions on behalf of the victim, or exfiltrate sensitive data from the application.

For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-39400

Indicators of Compromise

• Presence of JavaScript code or HTML event handlers (e.g., <script>, onerror, onclick) in job output fields within the Cronicle database
• Unusual network requests originating from the Cronicle web interface to external domains
• Reports from users of unexpected behavior or pop-ups when viewing job details
• Audit logs showing creation of jobs with suspicious output content by low-privileged users

Detection Strategies

• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Monitor Cronicle job output fields for common XSS patterns including <script>, javascript:, and HTML event attributes
• Enable browser console monitoring for JavaScript errors that may indicate blocked XSS attempts
• Review job creation and execution logs for accounts with create_events and run_events privileges creating unusual output patterns

Monitoring Recommendations

• Deploy web application firewalls (WAF) to inspect traffic to and from the Cronicle interface for XSS payloads
• Configure browser-based security monitoring to alert on CSP violations from the Cronicle application
• Regularly audit user permissions to ensure create_events and run_events privileges are appropriately restricted
• Monitor for anomalous session activity following job detail page views

How to Mitigate CVE-2026-39400

Immediate Actions Required

• Upgrade Cronicle to version 0.9.111 or later immediately
• Review existing job outputs in the database for potential XSS payloads
• Audit user accounts with create_events and run_events privileges and revoke unnecessary permissions
• Implement Content Security Policy headers as a defense-in-depth measure

Patch Information

This vulnerability is fixed in Cronicle version 0.9.111. The patch addresses the issue by implementing proper sanitization of job output fields before storage and safe rendering practices on the client side. Users should upgrade to this version or later to remediate the vulnerability.

For patch details and upgrade instructions, refer to the GitHub Security Advisory.

Workarounds

• Restrict create_events and run_events privileges to only trusted administrator accounts until the patch is applied
• Implement a reverse proxy with output filtering to strip potentially malicious content from job detail responses
• Deploy strict Content Security Policy headers to mitigate XSS impact by preventing inline script execution
• Consider temporarily disabling the Job Details feature if feasible in your environment

# Example: Adding CSP headers via nginx reverse proxy
# Add to your Cronicle server block configuration
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';" always;