CVE-2026-90489: Xuxueli xxl-job XSS Vulnerability

CVE-2026-90489 Overview

CVE-2026-90489 is a cross-site scripting (XSS) vulnerability in Xuxueli xxl-job versions up to 3.5.0. The flaw resides in the /jobinfo/insert endpoint, where the name and author arguments are not properly sanitized before being rendered. An authenticated attacker can inject arbitrary JavaScript that executes in the browser of any user viewing the affected job data. The exploit is publicly documented, and the vendor did not respond to disclosure attempts.

Critical Impact

Authenticated attackers can inject persistent JavaScript into job records, enabling session hijacking, credential theft, or unauthorized actions against xxl-job administrators.

Affected Products

• Xuxueli xxl-job versions up to and including 3.5.0
• /jobinfo/insert endpoint accepting name and author parameters
• Web-based management console of xxl-job scheduler

Discovery Timeline

• 2026-09-13 - CVE-2026-90489 published to NVD
• 2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-90489

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw [CWE-79] in the xxl-job scheduler management interface. The /jobinfo/insert handler accepts user-controlled name and author fields when creating scheduled tasks. These values are persisted in the backend and later rendered in the administrative UI without adequate output encoding.

An attacker with permission to create jobs can supply HTML or JavaScript payloads in either parameter. When another user, typically an administrator, loads the job list or job detail view, the browser parses and executes the injected script in the trusted origin of the xxl-job console. Attackers can leverage this to steal session cookies, perform actions on behalf of the victim, or pivot to backend job manipulation. The public availability of the proof-of-concept increases the likelihood of opportunistic exploitation.

Root Cause

The root cause is missing input sanitization and output encoding on the name and author parameters processed by /jobinfo/insert. The application stores raw user input and reflects it into HTML contexts without applying context-aware escaping, violating standard XSS prevention practices.

Attack Vector

Exploitation occurs over the network and requires low privileges plus a victim interaction, since a second user must render the malicious job record. Once triggered, the script runs in the victim's authenticated session on the xxl-job interface. Technical details are documented in the GitHub CVE XSS Analysis and the VulDB CVE-2026-90489 Details.

No verified exploit code is reproduced here; see the referenced advisories for payload specifics.

Detection Methods for CVE-2026-90489

Indicators of Compromise

• Job records in the xxl-job database containing <script>, onerror=, onload=, or javascript: substrings in the name or author columns.
• HTTP POST requests to /jobinfo/insert with encoded HTML entities or angle brackets in the name or author parameters.
• Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing the job console.

Detection Strategies

• Inspect application access logs for POST requests to /jobinfo/insert containing suspicious characters such as <, >, or %3C in the tracked parameters.
• Query the xxl-job job metadata table for stored values containing HTML tags or JavaScript event handlers.
• Deploy Content Security Policy (CSP) violation reporting to surface script execution from untrusted inline sources.

Monitoring Recommendations

• Forward xxl-job web server logs to a centralized SIEM and alert on parameter values matching known XSS patterns.
• Baseline typical name and author values used by legitimate operators and flag deviations.
• Monitor administrator sessions for anomalous API activity that could indicate hijacked cookies.

How to Mitigate CVE-2026-90489

Immediate Actions Required

• Restrict access to the xxl-job administrative interface to trusted internal networks or via VPN only.
• Audit existing job records for injected script content and sanitize or remove offending entries.
• Enforce strict role-based access controls so untrusted users cannot create or edit jobs.

Patch Information

No vendor patch is available. According to the disclosure, the vendor was contacted but did not respond. Organizations running xxl-job versions up to 3.5.0 should track the VulDB Vulnerability Details #403077 for future updates and evaluate applying a private fix that HTML-encodes the name and author fields on both input validation and output rendering.

Workarounds

• Deploy a web application firewall (WAF) rule that blocks HTML tags and JavaScript event handlers in POST parameters submitted to /jobinfo/insert.
• Implement a strict Content Security Policy that disallows inline scripts in the xxl-job console to reduce XSS impact.
• Apply a reverse-proxy filter that HTML-encodes the name and author fields before responses reach browsers.
• Rotate administrator session tokens and credentials if injected content is discovered in job records.