CVE-2026-94145 in xxl-job
Summary
by MITRE • 09/21/2026
A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Management Interface. The manipulation of the argument name/author leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The identified vulnerability resides within the xxl-job distributed task scheduling framework, specifically affecting versions up through 3.4.2 and 3.5.0. This security flaw is located in the JobInfoController component, which serves as a primary interface for managing scheduled tasks within the application architecture. The core technical deficiency involves improper input validation and sanitization mechanisms applied to user-supplied data fields, specifically those corresponding to job arguments such as name and author metadata. When these parameters are processed by the backend logic without adequate encoding or escaping prior to being rendered in subsequent HTTP responses, they become vectors for cross-site scripting attacks. This classification aligns with CWE-79, which defines Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting (XSS). The vulnerability allows an attacker to inject malicious client-side scripts into web pages viewed by other users or administrators interacting with the xxl-job administration console.
From a technical perspective, the exploitation mechanism relies on the application's failure to properly sanitize special characters within the input fields before they are embedded in HTML content. When a user submits a job configuration containing script tags or event handlers disguised as part of the name or author string, the server accepts this data and stores it without modification. Subsequently, when an administrator views the task list or details page, the browser interprets these stored payloads as executable code rather than static text. This scenario is characteristic of Stored Cross-Site Scripting, where the malicious payload persists on the target server until retrieved by a victim. The attack can be initiated remotely by any authenticated user who possesses write access to job configurations, making it particularly dangerous in multi-tenant or shared infrastructure environments where privilege escalation could lead to broader system compromise.
The operational impact of this vulnerability is significant due to its potential for session hijacking and administrative takeover. An attacker leveraging this flaw can execute arbitrary JavaScript code within the context of the victim's browser session. This capability enables the theft of sensitive cookies, including authentication tokens that maintain the user's logged-in state against the xxl-job admin interface. By capturing these credentials, an adversary could impersonate legitimate administrators to modify scheduling rules, delete critical jobs, or inject malicious task payloads into the execution pipeline. Furthermore, if the underlying server infrastructure is accessible via internal networks from the compromised client machine, the attacker might pivot further into the network using tools like BeEF or custom scripts that exploit local services. This aligns with ATT&CK technique T1059, Command and Scripting Interpreter, specifically within the context of browser-based exploitation leading to lateral movement potential depending on the deployment topology.
Although the vulnerability has been disclosed publicly and exploits are available for use, the vendor's lack of response indicates a critical gap in their security patch management cycle. Organizations relying on xxl-job must treat this as an active threat requiring immediate mitigation strategies since no official fix is currently provided by the maintainers. The primary remediation approach involves implementing strict input validation at both the client and server sides to ensure that only expected alphanumeric characters or safe symbols are accepted for job metadata fields. Additionally, deploying a Web Application Firewall with rules capable of detecting and blocking XSS payloads can provide an interim layer of defense. Developers should also enforce Content Security Policy headers to restrict script execution sources, thereby mitigating the impact even if injection occurs. Until an official patch is released, upgrading to newer versions once available or applying custom code patches that sanitize inputs using established libraries such as OWASP Java Encoder is strongly recommended to restore security posture and prevent unauthorized access to critical job scheduling operations.