Is CVE-2026-55562 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55562 being exploited in the wild.

How severe is CVE-2026-55562?

Critical severity, with a CVSS score of 9, published 13 October 2026.

Is there a fix for CVE-2026-55562?

Yes: fixed in 0.9.119. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55562 attacked?

It is attacked over the network.

Am I affected by CVE-2026-55562?

Check whether you run Cronicle at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55562: Cronicle stored XSS in Activity Log via user full name

CVE-2026-55562 · Severity: critical · CVSS 9 · Published 2026-10-13

Cronicle is a multi-server task scheduler with a web-based administration interface. An authenticated attacker or self-registered user can inject malicious JavaScript into their user profile name that executes in an administrator's browser when the Activity Log page is viewed, allowing the attacker to take over the admin account and execute arbitrary commands on the servers managed by Cronicle.

Technologies: Cronicle. Vendors: Cronicle.

Quick answers

Is CVE-2026-55562 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55562 being exploited in the wild.
How severe is CVE-2026-55562?: Critical severity, with a CVSS score of 9, published 13 October 2026.
Which products and versions are affected?: Cronicle prior to 0.9.119.
Is there a fix for CVE-2026-55562?: Yes: fixed in 0.9.119. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55562 attacked?: It is attacked over the network.
Am I affected by CVE-2026-55562?: Check whether you run Cronicle at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.9.119

Technical details

The vulnerability is a stored XSS in htdocs/js/pages/admin/Activity.js where the user.full_name field is concatenated directly into HTML via this.div.html() without encoding. The input validation filter in pixl-server-user can be bypassed by embedding a newline in an HTML tag, since the regex does not match across lines. An authenticated non-admin user can update their own name via /api/user/update, or an unauthenticated user can register with a malicious name if free_accounts is enabled; the payload executes when an administrator opens the Activity Log page.

Affected products

Cronicle Cronicle prior to 0.9.119

Timeline

2026-10-13: disclosed
2026-06-13: patched: Fix released in version 0.9.119

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.