# CVE-2026-55562: Cronicle stored XSS in Activity Log via user full name

Source: https://junglewise.ai/threats/cve-2026-55562-cronicle-is-a-multi-server-task-scheduler-and-runner-with-a-web  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-55562 · Severity: critical · CVSS 9 · Published 2026-10-13

Cronicle is a multi-server task scheduler with a web-based administration interface. An authenticated attacker or self-registered user can inject malicious JavaScript into their user profile name that executes in an administrator's browser when the Activity Log page is viewed, allowing the attacker to take over the admin account and execute arbitrary commands on the servers managed by Cronicle.

Technologies: [Cronicle](https://junglewise.ai/threats/technologies/cronicle). Vendors: [Cronicle](https://junglewise.ai/threats/vendors/cronicle).

## Quick answers

**Is CVE-2026-55562 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55562 being exploited in the wild.

**How severe is CVE-2026-55562?** Critical severity, with a CVSS score of 9, published 13 October 2026.

**Which products and versions are affected?** Cronicle prior to 0.9.119.

**Is there a fix for CVE-2026-55562?** Yes: fixed in 0.9.119. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55562 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-55562?** Check whether you run Cronicle at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.9.119

## Technical details

The vulnerability is a stored XSS in htdocs/js/pages/admin/Activity.js where the user.full_name field is concatenated directly into HTML via this.div.html() without encoding. The input validation filter in pixl-server-user can be bypassed by embedding a newline in an HTML tag, since the regex does not match across lines. An authenticated non-admin user can update their own name via /api/user/update, or an unauthenticated user can register with a malicious name if free_accounts is enabled; the payload executes when an administrator opens the Activity Log page.

## Affected products

- Cronicle Cronicle prior to 0.9.119

## Timeline

- 2026-10-13: disclosed
- 2026-06-13: patched: Fix released in version 0.9.119

## References

- [https://github.com/jhuckaby/Cronicle/commit/8b60eb5b041614ab661df50e58e612f5e42a7d30](https://github.com/jhuckaby/Cronicle/commit/8b60eb5b041614ab661df50e58e612f5e42a7d30)
- [https://github.com/jhuckaby/Cronicle/releases/tag/v0.9.119](https://github.com/jhuckaby/Cronicle/releases/tag/v0.9.119)

## Related threats

- [Cronicle privilege escalation via event field injection](https://junglewise.ai/threats/cve-2026-58255-cronicle-is-a-multi-server-task-scheduler-and-runner-with-a-web)
- [jhuckaby Cronicle missing authorization in job output parser](https://junglewise.ai/threats/cve-2026-39401-jhuckaby-cronicle-missing-authorization-in-job-output-parser)
- [Cronicle stored XSS in job output fields](https://junglewise.ai/threats/cve-2026-39400-cronicle-stored-xss-in-job-output-fields)