CVE-2026-39400

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39400", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-06T22:06:40.516Z", "datePublished": "2026-04-07T20:22:54.581Z", "dateUpdated": "2026-04-15T14:24:26.306Z"}, "containers": {"cna": {"title": "Stored XSS via Job HTML/Table Output in Cronicle", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/jhuckaby/Cronicle/security/advisories/GHSA-36q6-pwxv-j545", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/jhuckaby/Cronicle/security/advisories/GHSA-36q6-pwxv-j545"}], "affected": [{"vendor": "jhuckaby", "product": "Cronicle", "versions": [{"version": "< 0.9.111", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T20:22:54.581Z"}, "descriptions": [{"lang": "en", "value": "Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, a non-admin user with create_events and run_events privileges can inject arbitrary JavaScript through job output fields (html.content, html.title, table.header, table.rows, table.caption). The server stores this data without sanitization, and the client renders it via innerHTML on the Job Details page. This vulnerability is fixed in 0.9.111."}], "source": {"advisory": "GHSA-36q6-pwxv-j545", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-14T15:05:29.500038Z", "id": "CVE-2026-39400", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T14:24:26.306Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39400", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T15:05:29.500038Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T18:14:23.886Z"}}], "cna": {"title": "Stored XSS via Job HTML/Table Output in Cronicle", "source": {"advisory": "GHSA-36q6-pwxv-j545", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "jhuckaby", "product": "Cronicle", "versions": [{"status": "affected", "version": "< 0.9.111"}]}], "references": [{"url": "https://github.com/jhuckaby/Cronicle/security/advisories/GHSA-36q6-pwxv-j545", "name": "https://github.com/jhuckaby/Cronicle/security/advisories/GHSA-36q6-pwxv-j545", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, a non-admin user with create_events and run_events privileges can inject arbitrary JavaScript through job output fields (html.content, html.title, table.header, table.rows, table.caption). The server stores this data without sanitization, and the client renders it via innerHTML on the Job Details page. This vulnerability is fixed in 0.9.111."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T20:22:54.581Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39400", "state": "PUBLISHED", "dateUpdated": "2026-04-15T14:24:26.306Z", "dateReserved": "2026-04-06T22:06:40.516Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-07T20:22:54.581Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Cronicle", "vendor": "jhuckaby", "versions": [{"status": "affected", "version": "< 0.9.111"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cronicle:cronicle:*:*:*:*:*:*:*:*", "matchCriteriaId": "39B61EC4-D675-4546-9B1C-239E47AB6C5A", "versionEndExcluding": "0.9.111", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, a non-admin user with create_events and run_events privileges can inject arbitrary JavaScript through job output fields (html.content, html.title, table.header, table.rows, table.caption). The server stores this data without sanitization, and the client renders it via innerHTML on the Job Details page. This vulnerability is fixed in 0.9.111."}, {"lang": "es", "value": "Cronicle es un programador y ejecutor de tareas multi-servidor, con una interfaz de usuario (UI) de front-end basada en web. Antes de la versi\u00f3n 0.9.111, un usuario no administrador con privilegios de create_events y run_events puede inyectar JavaScript arbitrario a trav\u00e9s de los campos de salida de trabajos (html.content, html.title, table.header, table.rows, table.caption). El servidor almacena estos datos sin sanitizaci\u00f3n, y el cliente los renderiza a trav\u00e9s de innerHTML en la p\u00e1gina de Detalles del Trabajo. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 0.9.111."}], "id": "CVE-2026-39400", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39400", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-14T15:05:29.500038Z", "version": "2.0.3"}}]}, "published": "2026-04-07T21:17:18.333", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/jhuckaby/Cronicle/security/advisories/GHSA-36q6-pwxv-j545"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.9.111)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Cronicle", "source": "cna", "vendor": "jhuckaby"}, "product": "cronicle", "vendor": "jhuckaby"}], "analysis": {"en": {"generated_at": "2026-04-07T22:40:33.843107+00:00", "value": {"mitigation_remediation": ["Upgrade Cronicle to version 0.9.111 or later"], "summary": {"action": "Upgrade", "impact": "Stored XSS"}, "threat_synthesis": {"affected_systems": "Cronicle distributed by jhuckaby is affected. All releases prior to version 0.9.111 include the vulnerability. The issue was resolved in 0.9.111.", "description_and_impact": "Cronicle\u2019s web UI allows a non\u2011admin user with create_events and run_events privileges to inject arbitrary JavaScript into job output fields such as html.content, html.title, table.header, table.rows, and table.caption. The server stores this data without sanitization, and the client renders it via innerHTML on the Job Details page. Based on the description, it is inferred that an attacker could execute code in the context of any authenticated user who views a job detail page, potentially enabling session hijacking, defacement, or malicious actions.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in CISA\u2019s KEV catalog, implying no publicly known exploits. The attack vector requires authentication and web application interaction; a user must possess create_events or run_events rights to inject unsafe content, and an authenticated victim must later view a job detail for the payload to execute. Because the data is stored and rendered by the server, the risk is confined to the internal network or users with web UI access."}}}}, "created": "2026-04-08T19:34:20.848749+00:00", "updated": "2026-04-08T19:45:49.783424+00:00", "vendors": ["jhuckaby", "jhuckaby$PRODUCT$cronicle"]}