XXL‑Job versions up to 3.5.0‑SNAPSHOT contain a stored cross‑site scripting flaw. When an attacker submits a job definition, the controller saves the glueSource parameter without encoding. The FreeMarker template job.code.ftl renders this value unescaped, allowing arbitrary JavaScript to be executed in the context of any user who views the job code page. This can lead to browser‑based attacks such as data theft, session hijacking, or defacement. The flaw is a direct result of missing output encoding in a trusted template.

The vulnerability exists in XXL‑Job, versions 3.5.0‑SNAPSHOT and earlier. No vendor information was provided beyond the product name.

The CVSS score of 5.4 indicates medium severity. The EPSS score of less than 1% suggests a very low probability of exploitation in the near term. The flaw is not listed in the CISA KEV catalog. Exploitation likely requires authenticated access to the job editor to insert malicious glueSource, after which any user viewing the job page will execute the injected script. Detection would involve observing unexpected script execution in the job code view.