# CVE-2026-39400: Cronicle stored XSS in job output fields

Source: https://junglewise.ai/threats/cve-2026-39400-cronicle-stored-xss-in-job-output-fields  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-07. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-39400 · Severity: medium · CVSS 6.1 · Published 2026-04-07

Cronicle is a task scheduling and management tool used to automate server operations. A security flaw allows users with limited permissions to embed malicious scripts into task reports. If an administrator views these reports, the attacker could hijack their session, create unauthorized accounts, or execute arbitrary commands on the server, potentially leading to a full system takeover.

Technologies: [Cronicle](https://junglewise.ai/threats/technologies/cronicle). Vendors: [Cronicle](https://junglewise.ai/threats/vendors/cronicle).

## Quick answers

**Is CVE-2026-39400 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39400 being exploited in the wild.

**How severe is CVE-2026-39400?** Medium severity, with a CVSS score of 6.1, published 7 April 2026.

**Which products and versions are affected?** jhuckaby Cronicle < 0.9.111.

**Is there a fix for CVE-2026-39400?** A patch was published on 2026-04-07: Fix released in version 0.9.111 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39400 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-39400?** Check whether you run Cronicle. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in Cronicle prior to version 0.9.111. The vulnerability is located in the job output handling logic within `lib/job.js` and the rendering logic in `htdocs/js/pages/JobDetails.class.js`. A non-admin user with `create_events` and `run_events` privileges can inject arbitrary JavaScript into job output fields such as `html.content`, `html.title`, and various table fields. The server stores this data without sanitization, and the client-side UI subsequently renders it using `innerHTML`. An attacker can leverage this to execute scripts in the context of an administrator's browser session, potentially leading to session hijacking or remote code execution via the application's task runner. The issue is resolved in version 0.9.111 by implementing HTML escaping on user-controlled fields.

## Affected products

- jhuckaby Cronicle < 0.9.111

## Timeline

- 2026-04-03: advisory: GitHub security advisory published
- 2026-04-07: disclosed: CVE published to NVD
- 2026-04-07: patched: Fix released in version 0.9.111

## References

- [https://github.com/jhuckaby/Cronicle/security/advisories/GHSA-36q6-pwxv-j545](https://github.com/jhuckaby/Cronicle/security/advisories/GHSA-36q6-pwxv-j545)

## Related threats

- [Cronicle privilege escalation via event field injection](https://junglewise.ai/threats/cve-2026-58255-cronicle-is-a-multi-server-task-scheduler-and-runner-with-a-web)
- [Cronicle stored XSS in Activity Log via user full name](https://junglewise.ai/threats/cve-2026-55562-cronicle-is-a-multi-server-task-scheduler-and-runner-with-a-web)
- [jhuckaby Cronicle missing authorization in job output parser](https://junglewise.ai/threats/cve-2026-39401-jhuckaby-cronicle-missing-authorization-in-job-output-parser)