CVE-2026-94426: xuxueli xxl-job insert cross site scripting
A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown function of the file /jobgroup/insert. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What level of access and interaction are required to exploit this issue?
An attacker needs low-level privileges and must induce a user to interact with the crafted content. The attack can be initiated remotely over the network.
Which deployments should be considered potentially affected?
xxl-job versions up to 3.5.0 are identified as affected. The available information does not state whether the vulnerable functionality is enabled or reachable in a default deployment.
Is there public exploit information available?
Yes. The exploit has been publicly disclosed and may be used by attackers.
How can I assess exposure in my environment?
Identify xxl-job instances at version 3.5.0 or earlier and review access to the /jobgroup/insert endpoint. The affected input is the Name argument, so deployments where lower-privileged users can submit job-group names should be prioritized for review.