Orgs at Risk: Cronicle Stored XSS Lets Attackers Hijack Admins and Run Commands on Servers

The malicious code targets the web-based front-end of the Cronicle multi-server task scheduler. By exploiting a stored cross-site scripting vulnerability, attackers can inject scripts that execute within the browser session of any administrator who views the Activity Log. This allows the attacker to take over the administrator account and perform actions with elevated privileges, effectively gaining command execution capabilities through privileged Cronicle features on the underlying infrastructure.

How does the vulnerability function technically?

The vulnerability, identified as CVE-2026-55562, stems from improper input handling in the file htdocs/js/pages/admin/Activity.js. According to the National Vulnerability Database record, the application concatenates the value of item.user.full_name directly into HTML without applying necessary encoding. This occurs when the system inserts the data using this.div.html. The flaw is classified under CWE-79, which covers cross-site scripting issues where user-controlled data is rendered as executable code rather than plain text.

Who can exploit this flaw and how?

An authenticated non-administrator user can exploit this by updating their own display name through the /api/user/update endpoint using a valid session and current password. If the free_accounts setting is enabled, an anonymous attacker can plant the malicious name during the self-registration process. The bundled pixl-server-user input filter fails to block this because its regular expression does not match tags containing line breaks, allowing the malicious payload to bypass validation and be stored until an administrator views the log.

What is the impact on organizations?

The impact is severe because the injected script executes in the context of the administrator’s session. This enables administrator takeover, granting the attacker access to privileged Cronicle features. Once an administrator account is compromised, the attacker can leverage the scheduler’s capabilities to execute commands on the managed servers. The issue is fixed in version 0.9.119, but prior versions remain vulnerable to this specific vector of account compromise and subsequent command execution through privileged features.

What analysts watch for

Teams usually monitor for anomalous user profile updates that contain special characters or line breaks, which may indicate an attempt to bypass input filters. Analysts should examine the Activity Log for unexpected script tags or encoded payloads embedded in user names. Checking for new administrative sessions originating from unknown IP addresses or at unusual times can reveal successful exploitation. Investigating any sudden changes in task scheduling configurations or new command executions on managed servers helps identify post-compromise activity. Reviewing server logs for requests to the user update API with suspicious parameters is also standard procedure.

Background: National Vulnerability Database

The National Vulnerability Database lists known flaws but lacks deployment context. Do not treat every entry as an immediate emergency. Cross-reference findings with your asset inventory and usage patterns to determine real risk, rather than reacting to every new identifier.

Read the full guide: National Vulnerability Database: Five Common Misreadings and Fixes

What to do and how to stay safe: Cronicle

• Update Cronicle to version 0.9.119 or later to apply the vendor-provided fix for this vulnerability.
• Audit user profiles in the Activity Log for any entries containing HTML tags or unusual formatting.
• Review access logs for the /api/user/update endpoint to detect unauthorized profile modifications.
• Monitor for unexpected command executions or new tasks created by compromised administrative accounts.

Step-by-step guide: How Vulnerability Scanning Works: The Hidden Mechanics and Limits

General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-55562?

It is a critical stored cross-site scripting vulnerability in Cronicle versions prior to 0.9.119 that allows attackers to inject scripts into the administrator Activity Log.

How can an attacker trigger this exploit?

An attacker can trigger it by updating their user name via the API or during registration if free accounts are enabled, bypassing the input filter with line breaks.

Is there a fix available?

Yes, the issue is fixed in version 0.9.119 of the Cronicle task scheduler.