CVE-2026-94426

Received Received - Intake

Cross-Site Scripting in XXL-Job up to 3.5.0

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: VulDB

Description

A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown function of the file /jobgroup/insert. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-94426

EUVD

EUVD-2026-84245

Affected Vendors & Products

Vendor	Product	Version / Range
xuxueli	xxl-job	to 3.5.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability is a cross-site scripting (XSS) issue in xuxueli xxl-job versions up to 3.5.0. It exists in the /jobgroup/insert endpoint where the Name argument is improperly sanitized, allowing attackers to inject malicious scripts. The attack can be executed remotely.

Detection Guidance

This vulnerability involves a reflected cross-site scripting (XSS) flaw in xxl-job versions up to 3.5.0, specifically in the /jobgroup/insert endpoint where the Name parameter is improperly sanitized. To detect it, monitor HTTP requests to /jobgroup/insert with suspicious payloads in the Name parameter, such as <script>alert(1)</script>. Use tools like curl to test the endpoint: curl -X POST 'http://target/jobgroup/insert' -d 'Name=<script>alert(1)</script>' and check for script execution in responses.

Impact Analysis

This XSS vulnerability could allow attackers to execute malicious scripts in a user's browser when they access the vulnerable application. This may lead to theft of session cookies, account takeover, or defacement of web pages.

Compliance Impact

This vulnerability involves a reflected cross-site scripting (XSS) flaw in xxl-job up to 3.5.0, which could allow attackers to inject malicious scripts. Such vulnerabilities may lead to unauthorized data access or manipulation, potentially violating GDPR's data protection requirements or HIPAA's security rules for protected health information.

Mitigation Strategies

Upgrade xxl-job to a version beyond 3.5.0 to address the cross-site scripting vulnerability in the /jobgroup/insert endpoint. If an upgrade is not possible, restrict access to the vulnerable endpoint or apply input validation filters to sanitize the Name parameter.

Hi! I’m here to help you understand CVE-2026-94426. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70