CVE-2026-94145: xxl-job Task Management XSS Vulnerability

CVE-2026-94145 is a cross-site scripting flaw in xxl-job Task Management Interface affecting versions up to 3.4.2 and 3.5.0. Attackers can inject malicious scripts through task name and author fields. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2026-94145 Overview

CVE-2026-94145 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the xuxueli xxl-job distributed task scheduling platform. The flaw affects versions up to and including 3.4.2/3.5.0 and resides in the Task Management Interface, specifically the JobInfoController.java file located at xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/. Attackers can manipulate the name and author parameters to inject arbitrary script content. The exploit has been publicly disclosed and requires an authenticated user with low privileges to submit malicious input, and a second user to interact with the crafted job entry.

Critical Impact
Authenticated attackers can inject JavaScript into task metadata, executing scripts in the browser sessions of administrators who view the affected job list.

Affected Products

xuxueli xxl-job version 3.4.2
xuxueli xxl-job version 3.5.0
xxl-job-admin component — Task Management Interface

Discovery Timeline

2026-09-21 - CVE-2026-94145 published to the National Vulnerability Database (NVD)
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-94145

Vulnerability Analysis

The vulnerability exists in the job creation and update endpoints exposed by JobInfoController.java within the xxl-job-admin web application. The controller accepts user-supplied values for the name (task description) and author fields without applying sufficient output encoding when the values are later rendered in the administrative task list view. This design permits a low-privileged authenticated user to persist HTML or JavaScript payloads inside task metadata. When another user, typically an administrator, loads the Task Management Interface, the browser interprets the injected markup as executable script. The vendor was contacted about the disclosure but did not respond, and no patched release has been announced. See the GitHub proof-of-concept writeup for reproduction steps.

Root Cause

The root cause is missing or inadequate contextual output encoding of the name and author request parameters before they are rendered in HTML context. The controller trusts input that has already passed authentication, so no sanitization is applied prior to persistence or display.

Attack Vector

Exploitation requires network access to the xxl-job-admin console and a valid low-privileged account. An attacker submits a crafted job entry containing a script payload in the name or author field. The payload triggers when a victim user browses the task list, allowing session token theft, forced actions on behalf of the victim, or pivoting inside the scheduler console.

No verified exploit code is reproduced here. Refer to the VulDB vulnerability entry and the public proof-of-concept for full technical details.

Detection Methods for CVE-2026-94145

Indicators of Compromise

Task entries in the xxl-job-admin database whose job_desc or author columns contain HTML tags such as <script>, <img onerror=>, or javascript: URIs.
HTTP POST requests to /xxl-job-admin/jobinfo/add or /xxl-job-admin/jobinfo/update containing angle brackets or encoded script payloads in the jobDesc or author parameters.
Unexpected outbound requests originating from administrator browsers immediately after loading the task management page.

Detection Strategies

Inspect web server access logs for suspicious payloads in job creation and update requests to JobInfoController endpoints.
Query the xxl_job_info table for rows where job_desc or author contain characters such as <, >, or &#.
Deploy content security policy (CSP) violation reporting to surface inline script execution in the admin console.

Monitoring Recommendations

Alert on new or modified job entries submitted by non-administrator accounts and review the submitted metadata.
Monitor administrator sessions for anomalous API calls issued shortly after opening the task list view.
Forward xxl-job-admin application logs to a centralized platform for correlation with authentication events.

How to Mitigate CVE-2026-94145

Immediate Actions Required

Restrict network access to the xxl-job-admin console to trusted management networks only.
Audit existing job entries and remove any records containing HTML or script content in the name or author fields.
Enforce least-privilege access so that only vetted users can create or modify scheduler jobs.
Deploy a strict Content Security Policy on the xxl-job-admin application to block inline script execution.

Patch Information

As of the disclosure, the vendor has not issued a security patch or acknowledged the report. Track the VulDB CVE entry and the upstream xxl-job project for updated releases beyond 3.5.0. Until a fixed version is available, apply the compensating controls listed below.

Workarounds

Place the xxl-job-admin interface behind a reverse proxy or web application firewall (WAF) that filters HTML tags in jobDesc and author parameters.
Add server-side input validation to reject non-alphanumeric characters in the name and author fields at the ingress layer.
Apply HTML entity encoding to job metadata within any customized admin templates before rendering.

bash

# Example WAF rule (ModSecurity) to block script payloads in job metadata
SecRule ARGS:jobDesc|ARGS:author "@rx (?i)(<script|onerror=|javascript:|<img|<svg)" \
    "id:1094145,phase:2,deny,status:403,log,msg:'CVE-2026-94145 XSS attempt in xxl-job'"