Executive brief
Xuxueli xxl-job is a distributed task scheduling platform used to manage scheduled jobs across multiple servers. A regular user can inject malicious JavaScript code into job name and author fields that executes when administrators view the task management interface, potentially allowing credential or session token theft.
Technical details
This is a reflected/stored cross-site scripting (XSS) vulnerability in the /jobinfo/insert endpoint of xxl-job up to version 3.5.0. The vulnerability exists because the XssUtil filter does not properly sanitize event handler attributes (such as onmousemove, oncopy) in the name and author parameters. A regular (non-admin) user can craft a POST request containing malicious JavaScript in these fields; when an administrator accesses the task management interface to view job details, the unfiltered payload executes in the admin's browser context. This allows attackers to steal session cookies, authentication tokens, or perform actions on behalf of the administrator. Authentication is required to trigger the vulnerability, but the attack is network-accessible and exploits have been publicly disclosed.
Affected products
- Xuxueli xxl-job up to 3.5.0
Timeline
- 2026-09-13: disclosed: Vulnerability published on NVD
- exploited: Public exploit available on GitHub