Cronicle, a multi-server task scheduler with a web UI, prior to version 0.9.111, improperly neutralizes input during web page generation. Specifically, non-admin users with certain privileges can inject arbitrary JavaScript into job output fields such as html.content, html.title, table.header, table.rows, and table.caption. The server stores this data without sanitization, and the client renders it using innerHTML on the Job Details page, leading to a stored cross-site scripting vulnerability (CWE-79). The issue is resolved in version 0.9.111.

An attacker with create_events and run_events privileges can execute arbitrary JavaScript in the context of the victim's browser when viewing the Job Details page. This could lead to session hijacking, unauthorized actions, or other client-side impacts typical of XSS vulnerabilities. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, and limited privileges required.

Upgrade Cronicle to version 0.9.111 or later, where this vulnerability is fixed. Since the vendor advisory confirms the fix in 0.9.111, applying this official update fully mitigates the issue. No additional mitigations are indicated.