CVE-2026-94426

Name of the Vulnerable Software and Affected Versions xuxueli xxl-job versions prior to 3.5.1

Description A remote attacker can initiate cross site scripting (XSS)—a technique used to inject malicious scripts into web pages viewed by other users—by manipulating the Name argument within an unknown function of the /jobgroup/insert endpoint.

Recommendations Update xuxueli xxl-job to a version newer than 3.5.0. Avoid using the Name argument in the /jobgroup/insert endpoint until the issue is resolved.