# CVE-2026-106706: XXL-JOB stored XSS in job code editor

Source: https://junglewise.ai/threats/cve-2026-106706-xxl-job-through-3-5-0-snapshot-is-vulnerable-to-stored-cross  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-106706 · Severity: medium · CVSS 5.4 · Published 2026-10-15

XXL-JOB is a distributed task scheduling framework used to manage and execute jobs. An authenticated user with access to a job group can inject malicious HTML or JavaScript into a job's glue source code, which is then rendered unescaped in the job code page. When another user views the affected job, the injected script executes in their browser within their authenticated session, potentially allowing the attacker to steal credentials, perform unauthorized actions, or steal sensitive data.

Vendors: [Xuxueli](https://junglewise.ai/threats/vendors/xuxueli).

## Quick answers

**Is CVE-2026-106706 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106706 being exploited in the wild.

**How severe is CVE-2026-106706?** Medium severity, with a CVSS score of 5.4, published 15 October 2026.

**Which products and versions are affected?** Xuxueli XXL-JOB through 3.5.0-SNAPSHOT.

**Is there a fix for CVE-2026-106706?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-106706 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-106706?** Check whether you run Xuxueli XXL-JOB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored XSS in JobCodeController.save() and job.code.ftl template. An authenticated user submits a crafted glueSource parameter via POST /jobcode/save that breaks out of a textarea context; the FreeMarker template renders this unescaped value, allowing arbitrary script execution when accessed by other users. The attack requires authentication and user interaction (viewing the job page), but affects all users in the victim's authenticated context.

## Affected products

- Xuxueli XXL-JOB through 3.5.0-SNAPSHOT

## Timeline

- 2026-10-15: disclosed

## References

- [https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106706.md](https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106706.md)
- [https://github.com/xuxueli/xxl-job](https://github.com/xuxueli/xxl-job)

## Related threats

- [XXL-JOB cross-site request forgery in user management](https://junglewise.ai/threats/cve-2026-106708-xxl-job-3-5-0-snapshot-and-earlier-contains-a-cross-site-request)