Medium severity · published Apr 7, 2026
CVE-2026-39400
Stored XSS via Job HTML/Table Output in Cronicle
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, a non-admin user with create_events and run_events privileges can inject arbitrary JavaScript through job output fields (html.content, html.title, table.header, table.rows, table.caption). The server stores this data without sanitization, and the client renders it via innerHTML on the Job Details page. This vulnerability is fixed in 0.9.111.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CR
Cronicle · jhuckaby
< 0.9.111 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-39400
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-39400
Exploit
https://github.com/jhuckaby/Cronicle/security/advisories/GHSA-36q6-pwxv-j545
More from Cronicle
9.0
CVE-2026-55562
Cronicle: Stored XSS in admin Activity Log via account full_name field
8.8
CVE-2026-58255
Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401
5.4
CVE-2026-39401
Privilege Escalation via update_event Job Output in Cronicle