CVE-2026-94145 xuxueli CVE debrief

Who should care

Defenders responsible for xxl-job instances, especially those using versions up to 3.4.2/3.5.0, should assess the risk of cross-site scripting attacks and prioritize verification and potential patching.

Why it matters

This vulnerability in xxl-job up to 3.4.2/3.5.0 allows for cross-site scripting attacks, which can be initiated remotely. Defenders should prioritize verifying the presence of this vulnerability and assessing the risk of such attacks.

• Defenders need to verify the presence of this vulnerability in their xxl-job instances
• Cross-site scripting attacks may be possible if the vulnerability is not patched
• The exploit has been disclosed publicly and may be used by attackers

Technical summary

The vulnerability affects the Task Management Interface of xuxueli xxl-job up to 3.4.2/3.5.0. The manipulation of the argument name/author leads to cross-site scripting. This issue can be initiated remotely. Defenders should prioritize verifying the presence of this vulnerability in their xxl-job instances, especially if they are using versions up to 3.4.2/3.5.0, and assess the risk of cross-site scripting attacks. The exploit has been disclosed publicly and may be used by attackers. The vendor was contacted early about this disclosure but did not respond.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their xxl-job instances, especially if they are using versions up to 3.4.2/3.5.0, and assess the risk of cross-site scripting attacks.

Recommended defensive actions

• Verify the presence of this vulnerability in xxl-job instances
• Assess the risk of cross-site scripting attacks
• Consider applying patches or mitigations if available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail page provide information about this vulnerability. However, the vendor did not respond to the disclosure. Additional details can be found in the source references. The exploit has been disclosed publicly and may be used by attackers. Defenders need to verify the presence of this vulnerability in their xxl-job instances and assess the risk of cross-site scripting attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.