CVE-2026-106707: n/a

CVE-2026-106707 is a stored XSS vulnerability in XXL-JOB <=3.5.0-SNAPSHOT. It affects the job log list page (/joblog) where an authenticated user with permission on a target executor job group can inject arbitrary JavaScript code through the executorParam parameter of the POST /jobinfo/trigger manual-trigger endpoint. The vulnerability allows script injection that can lead to information disclosure or other impacts within the context of the affected user's session.

The vulnerability allows an authenticated user with limited privileges to inject and execute arbitrary JavaScript in the context of the web application. This can lead to information disclosure and potential session hijacking or other client-side impacts. The CVSS score of 5.4 reflects a medium severity with low attack complexity, network attack vector, and requiring privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict permissions to trusted users only and monitor for suspicious activity related to the manual-trigger endpoint. Avoid exposing the vulnerable endpoint to untrusted users.