CVE-2026-106706: XSS
XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS) in the GLUE code editor. JobCodeController.save() stores the user-supplied glueSource parameter without output encoding, and the FreeMarker template job.code.ftl renders the stored value unescaped.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a low-privileged account and the ability to submit or modify GLUE code through the affected job-code save functionality. Exploitation also requires a user to view the page that renders the stored GLUE code.
What is the likely impact of successful exploitation?
Stored script content can execute in the browser of a user who views the affected GLUE code. The supplied vector indicates low confidentiality and integrity impact, with scope changed.
Are default deployments affected?
The available data identifies XXL-JOB through 3.5.0-SNAPSHOT as affected, but does not state whether the vulnerable GLUE editor or the required user permissions are enabled in a default deployment.
How can I determine whether my instance is exposed?
Check whether the deployment uses an affected XXL-JOB version and allows low-privileged users to save GLUE code. The vulnerable path is JobCodeController.save() accepting glueSource and job.code.ftl rendering that stored value without escaping.