CVE-2026-90488: Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection
Published Sep 12, 2026
·Updated
A vulnerability was determined in Xuxueli xxl-job up to 3.4.2. This affects the function GroovyClassLoader.parseClass of the file xxl-job-core/src/main/java/com/xxl/job/core/glue/GlueFactory.java. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
1 affected component
Xuxueli xxl-job<=3.4.2
Event History
Sep 12, 2026
CVE Published
via MITRE·11:15 PM
Data Sourced
via MITRE·11:15 PM
DescriptionSeverityWeakness
Sep 13, 2026
Data Sourced
via NVD·12:17 AM
DescriptionSeverityWeakness
Jun 23, 58669
Event
via NVD·05:07 AM
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that low-level privileges are required. User interaction is not required.
2
Can this be exploited remotely, and is exploit code available?
Remote exploitation is possible. The exploit has been publicly disclosed and may be used by attackers.
3
What impact is indicated if exploitation succeeds?
The CVSS assessment indicates low impact to confidentiality, integrity, and availability.