CVE-2026-90489 describes a cross-site scripting (XSS) vulnerability in Xuxueli xxl-job versions up to 3.5.0. The flaw is located in the /jobinfo/insert endpoint where manipulation of the 'name' and 'author' parameters can lead to script injection. This vulnerability can be exploited remotely and publicly available exploit code exists. The vendor was contacted but did not provide any response or patch information. The CVSS 3.1 base score is 3.5, reflecting low severity with network attack vector, low attack complexity, requiring low privileges and user interaction, and impacts integrity only.

Successful exploitation allows an attacker to perform cross-site scripting attacks by injecting malicious scripts via the 'name' or 'author' parameters in the /jobinfo/insert endpoint. This can lead to limited integrity impact such as script execution in the context of a victim user. There is no direct impact on confidentiality or availability according to the CVSS vector. The vulnerability can be exploited remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should consider implementing input validation and output encoding on the affected parameters as a temporary mitigation. Monitor official vendor channels for updates or patches.