PT-2026-31019 · Cronicle · Cronicle

Morimori-Dev · CVE-2026-39400 · Published 2026-04-07 · Updated 2026-04-08

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cronicle versions prior to 0.9.111

Description Cronicle is a multi-server task scheduler and runner with a web-based front-end UI. A non-admin user with create events and run events privileges can inject arbitrary JavaScript through job output fields, including html.content, html.title, table.header, table.rows, and table.caption. The server stores this data without sanitization, and the client renders it via innerHTML on the Job Details page.

Recommendations Update to version 0.9.111 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-39400

GHSA-36Q6-PWXV-J545

Affected Products

Cronicle

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39400.json · Exploit
• https://github.com/jhuckaby/Cronicle/security/advisories/GHSA-36q6-pwxv-j545 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-39400 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39400 · Security Note
• https://twitter.com/VulmonFeeds/status/2041737327626604915 · Twitter Post
• https://twitter.com/CVEnew/status/2041711881908580395 · Twitter Post