CVE-2026-90489: Xuxueli xxl-job insert cross site scripting
A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name/author leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What access and user interaction are required for exploitation?
The attack can be performed remotely, but it requires low-level privileges and user interaction. The affected inputs are the name and author arguments submitted to /jobinfo/insert.
Which deployments should be prioritized for review?
Xuxueli xxl-job versions up to 3.5.0 are identified as affected. Prioritize instances where users with low-level privileges can create job information and other users may view the submitted values.
Is exploitation likely to be practical?
A public exploit is available and may be used. The supplied assessment rates exploit maturity as proof-of-concept.
Is a vendor fix or response documented?
No vendor response is documented. The vendor was contacted before disclosure but did not respond, and the provided data does not identify a patch or fixed version.