Cronicle: Stored XSS in admin Activity Log via user full name
Summary
Cronicle, a multi-server task scheduler with a web front-end, does not encode the user full name when it is shown in the administrator Activity Log. A user can store a script in their own full name, or during self-registration if free_accounts is enabled, and it runs when an administrator opens the Activity Log. This can lead to administrator takeover and, through privileged Cronicle features such as the Shell Plugin, command execution on the server.
Affected
- Cronicle versions before 0.9.119
- Per the advisory, all versions up to and including v0.9.118
Fixed in
- Version 0.9.119 (commit 8b60eb5b041614ab661df50e58e612f5e42a7d30)
Workaround
- No vendor-published workaround.
- Disable self-registration (free_accounts) if it is enabled.
- Review existing user full names for HTML or script content.
- Consider a Content-Security-Policy at the reverse proxy; test before relying on it.
Exploitation
- CISA SSVC: exploitation status 'poc', automatable: no, technical impact: total.
- Known exploited (CISA KEV): not found.
- No independent public proof of concept found; the advisory author verified the behaviour in their own testing.
Our recommendation
- Update Cronicle to version 0.9.119 or later.
- Check whether free_accounts is enabled and whether the admin UI is reachable from the internet; prioritise internet-facing or self-registration instances.
- Review user accounts and full names for suspicious script content.
- Restrict administrator accounts and monitor for unexpected changes to users, jobs and plugins.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-vh39-3pcm-2j63 github.com
- Cronicle release v0.9.119 github.com
- Fix commit 8b60eb5 github.com
- OSV entry CVE-2026-55562 osv.dev
- VulDB entry 417809 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:13.
Original description (NVD)
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.full_name value into HTML without applying encode_entities and inserts the result through this.div.html. The bundled pixl-server-user input filter can be bypassed by a tag containing a line break because its regular expression does not match newlines. An authenticated non-administrator can update the attacker's own name through /api/user/update using a valid session and current password; when free_accounts is enabled, an anonymous attacker can instead plant the name during self-registration. The stored name executes script in an administrator's session when the Activity Log is opened, enabling administrator takeover and subsequent command execution through privileged Cronicle features. This issue is fixed in version 0.9.119.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.