CVE-2026-106707: XSS
XXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the job log list page (/joblog). An authenticated user who holds permission on a target executor job group can inject arbitrary JavaScript via the executorParam argument of the manual-trigger endpoint POST /jobinfo/trigger.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have permission for the target executor job group. Exploitation also requires access to the manual-trigger endpoint, POST /jobinfo/trigger.
Where is the injected content rendered?
The injected JavaScript is stored through the executorParam argument supplied to the manual-trigger endpoint and is rendered on the job log list page at /joblog. A user must view the affected log content for the script to execute.
Are unauthenticated or default-only deployments affected?
The available information identifies authentication, job-group permission, and user interaction as prerequisites. It does not establish whether a default XXL-JOB configuration grants the required permissions or exposes a usable attack path to unauthenticated users.