Is CVE-2026-106707 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106707 being exploited in the wild.

How severe is CVE-2026-106707?

Medium severity, with a CVSS score of 5.4, published 15 October 2026.

Which products and versions are affected?

Xuxueli XXL-JOB Admin <=3.5.0-SNAPSHOT.

Is there a fix for CVE-2026-106707?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-106707 attacked?

It is attacked over the network.

Am I affected by CVE-2026-106707?

Check whether you run Xuxueli XXL-JOB Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106707: XXL-JOB stored cross-site scripting in job log page

Q: Is there a fix for CVE-2026-106707?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-106707 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-106707?

Check whether you run Xuxueli XXL-JOB Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106707 · Severity: medium · CVSS 5.4 · Published 2026-10-15

XXL-JOB is a distributed task scheduling framework that manages job execution across multiple servers. The vulnerability allows an authenticated user to inject malicious JavaScript code through job parameters, which gets stored and then executed in the browsers of other users viewing job logs, potentially leading to account compromise or data theft.

Vendors: Xuxueli.

Quick answers

Is CVE-2026-106707 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106707 being exploited in the wild.
How severe is CVE-2026-106707?: Medium severity, with a CVSS score of 5.4, published 15 October 2026.
Which products and versions are affected?: Xuxueli XXL-JOB Admin <=3.5.0-SNAPSHOT.
Is there a fix for CVE-2026-106707?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-106707 attacked?: It is attacked over the network.
Am I affected by CVE-2026-106707?: Check whether you run Xuxueli XXL-JOB Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored XSS vulnerability exists in XXL-JOB's job log list page (/joblog) where the executorParam parameter submitted to the POST /jobinfo/trigger endpoint is persisted without HTML encoding and rendered as raw HTML in the log table formatter. An authenticated user with permission on a target job group can inject arbitrary JavaScript; when other users with access to that group view the logs, the malicious script executes in their authenticated context.

Affected products

Xuxueli XXL-JOB Admin <=3.5.0-SNAPSHOT

Timeline

2026-10-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.