Executive brief
XXL-JOB is a popular distributed task scheduling framework used by businesses to manage background jobs and automated tasks. A security vulnerability in the administration console allows an attacker to inject malicious scripts into the system. If an administrator views the affected page, the script could execute in their browser, potentially allowing the attacker to perform unauthorized actions, steal session information, or disrupt automated business operations.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in xxl-job-admin versions prior to 3.4.0 within the JobInfoController.java component. The vulnerability is rooted in the lack of sanitization for the 'addressList' parameter, which accepts URL-encoded JavaScript payloads. An attacker can submit a crafted HTTP GET request to the /jobinfo/trigger endpoint to store a malicious script. When an authenticated user later accesses the job information or trigger logs, the payload executes in their browser. This can be leveraged to perform unauthorized administrative actions, such as modifying job code or exfiltrating sensitive session tokens. The issue is reportedly addressed in version 3.4.0.
Affected products
- xxl-job xxl-job-admin < 3.4.0
Timeline
- 2026-07-15: disclosed: Initial NVD publication and researcher disclosure