CVE-2026-90488
Received Received - Intake

Remote Code Execution in Xuxueli XXL-JOB

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A vulnerability was determined in Xuxueli xxl-job up to 3.4.2. This affects the function GroovyClassLoader.parseClass of the file xxl-job-core/src/main/java/com/xxl/job/core/glue/GlueFactory.java. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-14
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90488
EUVD
EUVD-2026-76922

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
xuxueli xxl-job to 3.4.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90488 is a code injection vulnerability in xxl-job up to version 3.4.2. It affects the GroovyClassLoader.parseClass function in the GlueFactory component. The issue allows authenticated users with jobGroup permissions to inject and execute arbitrary Groovy/Java code on the server, leading to Remote Code Execution (RCE). The vendor did not respond to the disclosure.

Detection Guidance

Check for xxl-job version 3.4.2 or earlier. Look for unauthorized Groovy jobs with suspicious code containing Runtime.exec() or similar commands. Inspect logs for GlueFactory.parseClass() calls without sandbox restrictions.

Impact Analysis

An attacker with normal user access and jobGroup permissions could exploit this to execute arbitrary system commands on the server with full privileges. This may allow file read/write operations, establishing reverse shells, or moving laterally within the network. The impact includes complete system compromise and potential data breaches.

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Non-compliance risks include legal penalties, fines, and reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade xxl-job to a version beyond 3.4.2. Implement a Groovy sandbox to restrict dangerous imports and method calls. Remove or disable any GLUE_GROOVY type jobs with suspicious code. Restrict jobGroup permissions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90488. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart