CVE-2026-90488 Overview
CVE-2026-90488 is a code injection vulnerability in Xuxueli xxl-job through version 3.4.2. The flaw resides in the GroovyClassLoader.parseClass function within xxl-job-core/src/main/java/com/xxl/job/core/glue/GlueFactory.java. Attackers with low privileges can send crafted Groovy source over the network to trigger arbitrary code execution on the executor. A public proof-of-concept exists on GitHub, and the vendor did not respond to disclosure attempts. The weakness is classified as [CWE-74] Improper Neutralization of Special Elements in Output Used by a Downstream Component.
Critical Impact
Authenticated remote attackers can execute arbitrary Groovy code on xxl-job executor nodes, leading to full command execution in the JVM process context.
Affected Products
- Xuxueli xxl-job versions up to and including 3.4.2
- xxl-job-core component (GlueFactory.java)
- Deployments exposing the executor GLUE task interface over the network
Discovery Timeline
- 2026-09-13 - CVE-2026-90488 published to NVD
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-90488
Vulnerability Analysis
xxl-job is a distributed task scheduling platform that supports "GLUE mode" tasks written in Groovy. The GlueFactory component compiles user-supplied Groovy source using GroovyClassLoader.parseClass and instantiates the resulting class inside the executor JVM.
Because the source string is not sandboxed or validated, any content passed to parseClass is compiled and executed. Static initializers, constructors, or method bodies inside the submitted script run with the privileges of the executor process. An attacker who can reach the task submission path can therefore run arbitrary Java or Groovy code, invoke Runtime.exec, read local files, or pivot into internal networks.
Root Cause
The root cause is unrestricted use of a dynamic code evaluator. GroovyClassLoader.parseClass treats input as trusted source code. xxl-job does not apply a SecureASTCustomizer, allow-list, or code signing check before compilation, so injected Groovy is compiled and loaded into the executor classloader.
Attack Vector
Exploitation requires network access to an xxl-job admin or executor endpoint and low-privileged authentication. The attacker submits or edits a GLUE(Groovy) task containing malicious Groovy code. When the task is scheduled or triggered, the executor calls GlueFactory.loadNewInstance, which invokes parseClass on the payload and executes it. Detailed exploitation steps are documented in the public GitHub proof-of-concept and the VulDB entry for CVE-2026-90488.
No verified code examples are reproduced here. Refer to the linked advisory for the payload structure and request flow.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-90488
Indicators of Compromise
- Unexpected child processes of the xxl-job executor JVM, particularly sh, bash, cmd.exe, or powershell.exe.
- New or modified GLUE(Groovy) task definitions containing shell commands, reflection calls, or Runtime.getRuntime() invocations.
- Outbound network connections from executor hosts to unfamiliar IPs shortly after task execution.
Detection Strategies
- Inspect the xxl-job admin database xxl_job_info table for glue_type = 'GLUE_GROOVY' entries containing suspicious tokens such as Runtime, ProcessBuilder, exec, or curl.
- Enable audit logging on the admin console and alert on task create or update events performed by non-administrative accounts.
- Correlate executor process lineage with JVM parent processes to identify Groovy-driven command execution.
Monitoring Recommendations
- Forward xxl-job admin and executor logs to a centralized SIEM and retain task change history.
- Monitor for GroovyClassLoader compilation errors and repeated task failures, which often accompany payload development.
- Alert on network egress from executor subnets to internet destinations that fall outside documented job scope.
How to Mitigate CVE-2026-90488
Immediate Actions Required
- Restrict network access to the xxl-job admin console and executor ports so only trusted operators can submit tasks.
- Rotate all xxl-job admin and executor access tokens and remove unused low-privilege accounts.
- Audit existing GLUE(Groovy) tasks and remove any entries that were not authored by known administrators.
Patch Information
At the time of publication, the vendor has not issued a fixed release and did not respond to the disclosure. Track the VulDB vulnerability record #403076 and the upstream xxl-job repository for a patched version beyond 3.4.2.
Workarounds
- Disable GLUE(Groovy) task types in production and permit only BEAN-mode tasks defined in application code.
- Place the xxl-job admin console behind a VPN or reverse proxy that enforces strong authentication and IP allow-listing.
- Run executor processes as unprivileged users inside restricted containers to limit the blast radius of successful Groovy execution.
# Configuration example: block executor egress and restrict admin access
# 1. Firewall rule (Linux iptables) - allow admin only from bastion
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
# 2. Deny outbound internet from executor hosts
iptables -A OUTPUT -o eth0 -d 0.0.0.0/0 -j DROP
iptables -A OUTPUT -o eth0 -d 10.0.0.0/8 -j ACCEPT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
