CVE-2026-106706
Received Received - Intake

Stored XSS in XXL-JOB GLUE Code Editor

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: MITRE

Description
XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS) in the GLUE code editor. JobCodeController.save() stores the user-supplied glueSource parameter without output encoding, and the FreeMarker template job.code.ftl renders the stored value unescaped.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-16
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-106706
EUVD
EUVD-2026-102258

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in XXL-JOB through version 3.5.0-SNAPSHOT. It allows an authenticated user with job group access to inject malicious HTML or JavaScript into the glueSource parameter. When the job-code template renders this input, it executes unescaped scripts in the browser of any user viewing the affected job page.

Detection Guidance

Check XXL-JOB instances for suspicious job code entries containing HTML or JavaScript in the glueSource parameter. Inspect job pages for unescaped script tags or event handlers. Review server logs for POST requests to /jobcode/save with unusual payloads.

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of users, or access sensitive data. The impact requires valid credentials and job modification permissions. The CVSS score of 5.4 indicates medium severity with potential for information disclosure or unauthorized actions.

Mitigation Strategies

Upgrade XXL-JOB to a patched version beyond 3.5.0-SNAPSHOT. Implement output encoding for user-supplied data in the FreeMarker template. Restrict job modification permissions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106706. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart