CVE-2026-39400

OVERVIEW Cronicle versions prior to 0.9.111 contain a stored cross-site scripting (XSS) vulnerability in the job output fields. Non-administrative users with create_events and run_events privileges can inject arbitrary JavaScript through multiple HTML fields including html.content, html.title, table.header, table.rows, and table.caption. The vulnerability exists because the application stores unsanitized input and subsequently renders it via innerHTML on the Job Details page. SEVERITY The vulnerability carries a CVSS 3.1 score of 6.1 (Medium) with a network-based attack vector requiring no authentication. Attack complexity is low, though user interaction is required for exploitation. The impact includes compromised confidentiality and integrity of client-side data and sessions, though system availability is not affected. The relatively low EPSS score of 0.0003 indicates minimal current exploitation prevalence compared to other published vulnerabilities. EXPLOITATION STATUS There is no current evidence of active exploitation, as the vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and does not appear on any hot vulnerability lists. The community attention remains low, consistent with the modest CVSS rating and low EPSS score. Organizations running Cronicle should upgrade to version 0.9.111 or later to remediate this risk.