CVE-2026-90489
Received Received - Intake

Cross-Site Scripting in Xuxueli XXL-JOB

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name/author leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-14
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90489
EUVD
EUVD-2026-76924

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
xuxueli xxl-job to 3.5.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a cross-site scripting (XSS) vulnerability in Xuxueli xxl-job versions up to 3.5.0. It allows attackers to inject malicious JavaScript code via the 'name' and 'author' parameters in the '/jobinfo/insert' endpoint. The attack is triggered when an administrator views the task management interface, executing the injected code.

Detection Guidance

To detect this XSS vulnerability in xxl-job up to 3.5.0, check if the '/jobinfo/insert' endpoint is accessible and if user-controlled inputs like 'name' and 'author' parameters are reflected without proper sanitization. Test by sending payloads such as <img src=x onerror=alert(1)> in these parameters and observe if JavaScript executes when viewed by an admin.

Impact Analysis

An attacker could steal sensitive information like session cookies or credentials when an admin views the malicious task. This could lead to unauthorized account access, data theft, or further exploitation of the system.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Upgrade xxl-job to a version beyond 3.5.0 if available. If not, implement strict input validation for 'name' and 'author' parameters, and ensure XssUtil filters event handlers like 'oncopy' and 'onmousemove'. Restrict user permissions to prevent unauthorized task creation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90489. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart