CVE-2026-90489 in xxl-job
Summary
by MITRE • 09/13/2026
A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name/author leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/19/2026
The identified vulnerability within Xxl-Job, a distributed task scheduling platform up to version 3.5.0, represents a significant security risk due to its potential for remote code execution via client-side injection techniques. The flaw is located specifically within the input handling logic of the /jobinfo/insert endpoint, which is responsible for creating new job configurations in the system. This component fails to adequately sanitize or validate user-supplied data before processing it, allowing an attacker to inject malicious scripts into fields such as argument names and author identifiers. Because this functionality is typically accessible through a web-based administrative interface, the vulnerability falls squarely under the category of Cross-Site Scripting, specifically classified under CWE-79 in the Common Weakness Enumeration standard. This classification highlights the failure to neutralize special characters that have meaning within HTML or JavaScript contexts, thereby permitting the execution of arbitrary client-side scripts in the context of the vulnerable web application.
The operational impact of this vulnerability is severe because it enables a remote attacker to execute malicious code without requiring prior authentication if the administrative interface is exposed to untrusted networks, or with minimal privileges if internal access controls are weak. By exploiting the lack of input validation on the argument name and author fields, an adversary can craft a specially crafted HTTP request containing embedded JavaScript payloads. When this payload is stored in the database via the insert operation and subsequently rendered by other users viewing the job details page, it executes within their browser session. This scenario aligns with Persistent Cross-Site Scripting as defined in MITRE ATT&CK technique T1059.007 (HTML Injection), where the malicious script is stored on the target server for later use. The consequences can include session hijacking through cookie theft, credential harvesting via keylogging scripts, defacement of the administrative interface, or using the compromised user's browser to launch further attacks against internal network resources from a trusted context.
The availability of public exploits significantly elevates the threat landscape surrounding this vulnerability. Attackers do not need to develop custom tooling to leverage this flaw; instead, they can utilize existing proof-of-concept code found in public repositories or exploit databases to automate the attack process. This lowers the barrier to entry for less sophisticated adversaries and increases the likelihood of widespread exploitation across organizations that have not yet patched their systems. The fact that the vendor was contacted early but failed to respond indicates a critical gap in security maintenance practices, leaving users with no official patch timeline or guidance on remediation from the primary source. This lack of communication forces administrators to rely solely on community-driven mitigation strategies and self-imposed workarounds until an update is eventually released.
To mitigate this vulnerability, immediate action must be taken by system administrators and developers responsible for maintaining Xxl-Job instances. The most effective long-term solution is upgrading the software to a version where the input validation logic in the /jobinfo/insert endpoint has been corrected to properly encode or escape special characters before rendering them in HTML contexts. In the absence of an immediate patch, organizations should implement strict access controls on the administrative interface, ensuring it is not accessible from untrusted networks and that only authorized personnel with strong multi-factor authentication can interact with job creation endpoints. Additionally, deploying a Web Application Firewall (WAF) configured to detect and block common XSS patterns in POST requests targeting this endpoint can provide an additional layer of defense by intercepting malicious payloads before they reach the application logic. Regular security audits and code reviews focusing on input validation practices are essential to prevent similar flaws from persisting in future releases, particularly given the vendor's current lack of responsiveness to disclosed issues.