CVE-2026-55562
Received Received - Intake

Stored XSS in Cronicle Activity Log via User Name

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.full_name value into HTML without applying encode_entities and inserts the result through this.div.html. The bundled pixl-server-user input filter can be bypassed by a tag containing a line break because its regular expression does not match newlines. An authenticated non-administrator can update the attacker's own name through /api/user/update using a valid session and current password; when free_accounts is enabled, an anonymous attacker can instead plant the name during self-registration. The stored name executes script in an administrator's session when the Activity Log is opened, enabling administrator takeover and subsequent command execution through privileged Cronicle features. This issue is fixed in version 0.9.119.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-55562
EUVD
EUVD-2026-98908

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jhuckaby Cronicle < 0.9.119

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55562 is a stored cross-site scripting (XSS) vulnerability in Cronicle, a multi-server task scheduler with a web-based UI. The issue occurs in the Activity Log where user-controlled input is improperly sanitized and inserted into HTML without encoding. An attacker can exploit this by setting a malicious name via the /api/user/update endpoint or during self-registration if free_accounts is enabled. When an administrator views the Activity Log, the malicious script executes in their session, allowing the attacker to take over the administrator's account and execute privileged commands.

Detection Guidance

Check Cronicle version with: curl -s http://localhost:3060/api/version | grep version. Inspect Activity Log entries for unexpected script tags or HTML injection. Review user names for unusual characters or line breaks.

Impact Analysis

This vulnerability allows an attacker to execute arbitrary JavaScript in the context of an administrator's browser session. If you are an administrator, this could lead to full account compromise, unauthorized command execution, and potential control over the Cronicle server. If you are a regular user, an attacker could escalate privileges to gain administrative access and perform actions on your behalf.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's principles of data protection and user privacy. For HIPAA, it may result in unauthorized access to protected health information, compromising confidentiality and integrity requirements. Organizations using Cronicle must address this flaw to maintain compliance with these regulations.

Mitigation Strategies

Upgrade Cronicle to version 0.9.119 or later immediately. Disable free_accounts if enabled to prevent anonymous registration. Review and sanitize user names for any malicious content. Monitor Activity Log for suspicious entries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55562. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart