Executive brief
Cronicle is a task scheduling and management tool used to automate server operations. A security flaw allows users with limited permissions to embed malicious scripts into task reports. If an administrator views these reports, the attacker could hijack their session, create unauthorized accounts, or execute arbitrary commands on the server, potentially leading to a full system takeover.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in Cronicle prior to version 0.9.111. The vulnerability is located in the job output handling logic within `lib/job.js` and the rendering logic in `htdocs/js/pages/JobDetails.class.js`. A non-admin user with `create_events` and `run_events` privileges can inject arbitrary JavaScript into job output fields such as `html.content`, `html.title`, and various table fields. The server stores this data without sanitization, and the client-side UI subsequently renders it using `innerHTML`. An attacker can leverage this to execute scripts in the context of an administrator's browser session, potentially leading to session hijacking or remote code execution via the application's task runner. The issue is resolved in version 0.9.111 by implementing HTML escaping on user-controlled fields.
Affected products
- jhuckaby Cronicle < 0.9.111
Timeline
- 2026-04-03: advisory: GitHub security advisory published
- 2026-04-07: disclosed: CVE published to NVD
- 2026-04-07: patched: Fix released in version 0.9.111