CVE-2026-90489 Xuxueli CVE debrief

Who should care

Defenders responsible for Xuxueli xxl-job instances, especially those using version 3.5.0 or earlier, should assess their exposure to this vulnerability and prioritize verification and potential remediation.

Why it matters

CVE-2026-90489 is a cross-site scripting vulnerability in Xuxueli xxl-job up to 3.5.0 that allows remote attackers to execute arbitrary JavaScript code. Defenders should prioritize verifying the presence of this vulnerability in their instances, assessing the feasibility of remote cross-site scripting attacks, and implementing compensating controls to prevent such attacks.

• Defenders need to verify the presence of this vulnerability in their Xuxueli xxl-job instances.
• Remote cross-site scripting attacks may be feasible against vulnerable instances.
• Implementing compensating controls, such as input validation and output encoding, can help prevent cross-site scripting attacks.
• Monitoring vulnerable instances for suspicious activity is recommended.

Technical summary

The vulnerability affects unknown code of the file /jobinfo/insert in Xuxueli xxl-job up to 3.5.0. Manipulation of the argument name/author leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available, but there is no evidence of active exploitation. Defenders should prioritize verifying the presence of this vulnerability in their Xuxueli xxl-job instances, especially if they are using version 3.5.0 or earlier, and assess the feasibility of remote cross-site scripting attacks. Implementing compensating controls, such as input validation and output encoding, can help prevent cross-site scripting attacks.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their Xuxueli xxl-job instances, especially if they are using version 3.5.0 or earlier, and assess the feasibility of remote cross-site scripting attacks.

Recommended defensive actions

• Verify the presence of Xuxueli xxl-job version 3.5.0 or earlier in your environment.
• Assess the feasibility of remote cross-site scripting attacks against your Xuxueli xxl-job instances.
• Implement compensating controls, such as input validation and output encoding, to prevent cross-site scripting attacks.
• Monitor your Xuxueli xxl-job instances for suspicious activity.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide information about the vulnerability, but the vendor did not respond to the disclosure. The exploit is publicly available, but there is no evidence of active exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.