CVE-2026-55562 Cronicle: Stored XSS in admin Activity Log via account full_name field
An attacker can inject malicious scripts into the admin Activity Log via the user full_name field, leading to administrator account takeover and command execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-55562?
CVE-2026-55562 is a critical cross-site scripting vulnerability in jhuckaby Cronicle, published on 13 Oct 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.full_name value into HTML without applying encode_entities and inserts the result through this.div.html. The bundled pixl-server-user input filter can be bypassed by a tag containing a line break because its regular expression does not match newlines. An authenticated non-administrator can update the attacker's own name through /api/user/update using a valid session and current password; when free_accounts is enabled, an anonymous attacker can instead plant the name during self-registration. The stored name executes script in an administrator's session when the Activity Log is opened, enabling administrator takeover and subsequent command execution through privileged Cronicle features. This issue is fixed in version 0.9.119.
Weakness: CWE-79
Which versions are affected by CVE-2026-55562?
How do I fix CVE-2026-55562?
No fix has been published for CVE-2026-55562 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-55562 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55562 exists.
Sources
Also known as GHSA-vh39-3pcm-2j63.