CVE-2026-39400

Vulnerability

Cronicle prior to version 0.9.111 contains a stored cross-site scripting (XSS) vulnerability in its job output handling. The server accepts job output fields such as html.content, html.title, table.header, table.rows, and table.caption without any sanitization [1]. This unsanitized data is later rendered on the Job Details page using innerHTML on the client side, allowing arbitrary JavaScript execution [1].

Exploitation

An attacker who is a non-admin user with create_events and run_events privileges can craft a job that outputs malicious HTML containing JavaScript. For example, an attacker can set html.content to `` and submit the job results. When a victim (often an administrator) views the job details, the payload executes in the context of the victim's session [1].

Impact

Successful exploitation allows the attacker to perform any action that the victim can, including stealing session cookies, performing actions on behalf of the victim, or accessing sensitive information. The vulnerability is rated with a CVSS v3 score of 6.1 (Medium) [1].

Mitigation

The issue is fixed in Cronicle version 0.9.111. Users should upgrade to this version or later to eliminate the risk. No workaround is available other than restricting privileges for non-admin users [1].