PT-2026-31019 · Cronicle · Cronicle

Morimori-Dev · Published 2026-04-07 · Updated 2026-04-08 · CVE-2026-39400

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cronicle versions prior to 0.9.111

Description Cronicle is a multi-server task scheduler and runner with a web-based front-end UI. A non-admin user with create events and run events privileges can inject arbitrary JavaScript through job output fields, including html.content, html.title, table.header, table.rows, and table.caption. The server stores this data without sanitization, and the client renders it via innerHTML on the Job Details page.

Recommendations Update to version 0.9.111 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-39400

Affected Products

Cronicle

References · 4

• https://github.com/jhuckaby/Cronicle/security/advisories/GHSA-36q6-pwxv-j545 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39400 · Security Note
• https://twitter.com/VulmonFeeds/status/2041737327626604915 · Twitter Post
• https://twitter.com/CVEnew/status/2041711881908580395 · Twitter Post