CVE-2026-106706: n/a

CVE-2026-106706 describes a stored cross-site scripting vulnerability in XXL-JOB up to version 3.5.0-SNAPSHOT. The issue occurs in the GLUE code editor component where the JobCodeController.save() function saves the user-supplied glueSource parameter without applying output encoding. Subsequently, the FreeMarker template job.code.ftl renders this stored value without escaping, allowing malicious scripts to be persistently injected and executed in the context of users viewing the affected page.

An attacker with limited privileges can inject malicious scripts that are stored and later executed in the browsers of users who view the affected GLUE code editor page. This can lead to information disclosure and integrity impacts as indicated by the CVSS vector (Confidentiality and Integrity impacts are low, but the scope is changed). No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with user-supplied input in the GLUE code editor and consider applying output encoding or input validation as a temporary mitigation.