Stored XSS via Job HTML/Table Output in Cronicle

An attacker exploiting CVE-2026-39400 can inject malicious JavaScript code through the html.content, html.title, table.header, table.rows, and table.caption fields when creating or running jobs. Because Cronicle stores this data without sanitization and renders it using innerHTML on the Job Details page, the injected script will execute in the context of the user's browser. This could allow an attacker to steal session cookies, redirect users to phishing sites, deface the Cronicle UI, or potentially gain access to other systems if the user has elevated privileges. The blast radius is limited to the user's session and the Cronicle application itself, but the impact can be significant depending on the user's role and access rights.

1. 已保留2026-04-06
2. 发布日期2026-04-07
3. 修改日期2026-04-15
4. EPSS 更新日期2026-04-15

The primary mitigation for CVE-2026-39400 is to upgrade Cronicle to version 0.9.111 or later, which includes a fix for the XSS vulnerability. If immediate upgrade is not possible, consider implementing stricter input validation on the server-side to sanitize job output fields before storing them. While not a complete solution, a Web Application Firewall (WAF) configured to detect and block XSS payloads targeting the Job Details page could provide an additional layer of defense. Monitor Cronicle logs for suspicious activity, particularly around job creation and modification events. After upgrading, confirm the fix by creating a new job with a malicious JavaScript payload in one of the affected fields and verifying that the payload is not executed when viewing the Job Details page.