CVE-2026-39400: medium-severity vulnerability in jhuckaby Cronicle
Stored XSS via Job HTML/Table Output in Cronicle
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.2%
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, a non-admin user with create_events and run_events privileges can inject arbitrary JavaScript through job output fields (html.content, html.title, table.header, table.rows, table.caption). The server stores this data without sanitization, and the client renders it via innerHTML on the Job Details page. This vulnerability is fixed in 0.9.111.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Affected products
jhuckaby · CronicleRelated CVEs — jhuckaby Cronicle
In the same product, most dangerous first.
CVE-2026-55562CRITICALCronicle: Stored XSS in admin Activity Log via account full_name fieldEPSS 0.5%CVE-2026-58255HIGHCronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401EPSS 0.4%CVE-2026-39401MEDIUMPrivilege Escalation via update_event Job Output in CronicleEPSS 0.2%CVE-2026-85076CRITICALCronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)EPSS —