Sidekiq-cron, an open-source scheduling add-on for Sidekiq, is affected by an XSS vulnerability in versions up to 2.3.1. The issue occurs because a crafted URL is rendered unsafely from the cron.erb template, enabling an attacker to inject malicious scripts that could be executed in the context of a user's browser. The vulnerability was published in May 2026, but no official remediation or patch has been documented yet.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of a user's browser session when viewing the affected interface. This may lead to session hijacking, defacement, or other client-side attacks. However, no known exploits have been reported, and the overall impact depends on the deployment context and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing the vulnerable interface to untrusted users or apply manual input sanitization if feasible.