CVE-2026-94426: xxl-job XSS Vulnerability

CVE-2026-94426 Overview

CVE-2026-94426 is a cross-site scripting (XSS) vulnerability [CWE-79] in xuxueli xxl-job versions up to 3.5.0. The flaw resides in an unknown function of the /jobgroup/insert endpoint. Attackers can inject malicious script content through the Name parameter, which the application fails to sanitize before rendering. The attack is remotely initiated and requires low privileges plus user interaction. A public proof-of-concept exists, but no vendor response has been recorded following disclosure attempts.

Critical Impact
Authenticated attackers can inject arbitrary JavaScript through the job group Name field, enabling session hijacking, credential theft, or unauthorized actions in the context of other xxl-job administrators.

Affected Products

xuxueli xxl-job versions up to and including 3.5.0
Deployments exposing the /jobgroup/insert administration endpoint
Web-based xxl-job admin consoles accessed by multiple operators

Discovery Timeline

2026-09-21 - CVE-2026-94426 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94426

Vulnerability Analysis

The vulnerability affects the job group creation workflow in xxl-job, a distributed task scheduling platform. When an authenticated user submits a new job group through /jobgroup/insert, the Name parameter is stored and later rendered in the administrative interface without proper output encoding. This behavior allows attackers with basic access to plant persistent script payloads that execute in the browsers of other users who view the job group listings.

Successful exploitation runs in the context of an administrator's browser session. Attackers can exfiltrate session cookies, pivot to unauthorized job scheduling, or manipulate task execution parameters. Because xxl-job coordinates automated jobs across worker nodes, compromise of an admin session can extend to the orchestration layer itself.

Root Cause

The root cause is missing input sanitization and output encoding on user-controlled fields processed by the /jobgroup/insert handler. The Name argument accepts unfiltered HTML and JavaScript, which the front-end later reflects into the DOM. See the VulDB Vulnerability Analysis for further classification detail.

Attack Vector

The attack is network-based and requires an authenticated session with permission to create job groups. The attacker submits a crafted Name value containing script markup. When another user, typically an administrator, loads the job group management page, the stored payload executes in their browser. A public exploit has been referenced in the GitHub PoC Repository.

No verified code samples are available beyond the referenced proof-of-concept. Refer to the linked advisory for exact payload structure.

Detection Methods for CVE-2026-94426

Indicators of Compromise

Job group entries in the xxl-job database containing <script>, onerror=, onload=, or javascript: sequences in the Name column
Unexpected outbound HTTP requests from administrator browsers to attacker-controlled domains shortly after loading /jobgroup/pageList
Anomalous session activity or new privileged actions immediately following an admin's visit to the job group interface

Detection Strategies

Query the xxl-job database for job group names containing HTML tags, event handlers, or encoded script fragments
Inspect web server access logs for POST requests to /jobgroup/insert where the Name parameter contains angle brackets or URL-encoded script markers
Deploy a web application firewall rule to flag XSS payload patterns targeting the xxl-job admin path

Monitoring Recommendations

Enable audit logging on the xxl-job admin console and forward events to a centralized log platform for review
Alert on job group creation events performed by low-privilege accounts, especially outside business hours
Monitor browser Content Security Policy (CSP) violation reports from users accessing the admin interface

How to Mitigate CVE-2026-94426

Immediate Actions Required

Restrict access to the xxl-job admin console to trusted networks using firewall rules or a reverse proxy allowlist
Audit existing job group entries and remove any records containing HTML or script markup in the Name field
Review and reduce the number of accounts permitted to create or edit job groups

Patch Information

No vendor patch has been published at the time of disclosure. According to the CVE record, the vendor was contacted but did not respond. Track the VulDB CVE Details page for updates and monitor the upstream xxl-job repository for future releases beyond 3.5.0.

Workarounds

Enforce a strict Content Security Policy (CSP) on the xxl-job admin interface to block inline script execution
Deploy a WAF rule to sanitize or reject requests to /jobgroup/insert that contain HTML tags or script payloads in the Name parameter
Require administrators to access the console through a dedicated browser profile or isolated browsing environment
Limit job group creation privileges to a minimal set of trusted operators

bash

# Example nginx rule to block XSS payloads on the vulnerable endpoint
location /jobgroup/insert {
    if ($request_body ~* "(<script|onerror=|onload=|javascript:)") {
        return 403;
    }
    proxy_pass http://xxl_job_backend;
}