CVE-2026-94145: xuxueli xxl-job Task Management JobInfoController.java cross site scripting
A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Management Interface. The manipulation of the argument name/author leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to exploit this issue?
The attack can be initiated remotely, but the CVSS vector indicates the attacker needs low-level privileges and requires user interaction. Exploitation involves manipulating the name or author argument in the Task Management Interface.
Which deployments should be assessed?
Assess xuxueli xxl-job deployments running versions identified as up to 3.4.2/3.5.0, especially where the Task Management Interface is accessible to users who can supply job name or author values.
Is public exploitation material available?
Yes. The vulnerability description states that an exploit has been publicly disclosed and may be used.