Sidekiq‑cron through version 2.3.1 renders a cron configuration page using a template that likely incorporates values from a URL without proper escaping. An attacker who can craft a malicious URL can inject JavaScript that will execute in the context of the web application when an authenticated or unauthenticated user views the page. The injected code can steal session cookies, deface the interface or perform other actions within the victim’s browser, potentially leading to account compromise or data theft.

The vulnerable product is Sidekiq‑cron, an open‑source scheduling add‑on for the Sidekiq background job processor. All releases up to and including 2.3.1 contain the flaw. Users deploying any of these releases may be exposed if the cron.erb template is reachable in their environment.

The failure is a classic Cross‑Site Scripting weakness (CWE‑79). Because exploitation requires delivery of a crafted URL and a user to view the rendered page, the likelihood of real‑world attacks is moderate; the EPSS metric is not available and the vulnerability is not listed in CISA’s KEV catalog. The primary risk is the exposure of user credentials and session data through browser‑based attacks, rather than remote code execution on the server side.