Cronicle’s web UI allows a non‑admin user with create_events and run_events privileges to inject arbitrary JavaScript into job output fields such as html.content, html.title, table.header, table.rows, and table.caption. The server stores this data without sanitization, and the client renders it via innerHTML on the Job Details page. Based on the description, it is inferred that an attacker could execute code in the context of any authenticated user who views a job detail page, potentially enabling session hijacking, defacement, or malicious actions.

Cronicle distributed by jhuckaby is affected. All releases prior to version 0.9.111 include the vulnerability. The issue was resolved in 0.9.111.

The CVSS score of 5.3 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, implying no publicly known exploits. The attack vector requires authentication and web application interaction; a user must possess create_events or run_events rights to inject unsafe content, and an authenticated victim must later view a job detail for the payload to execute. Because the data is stored and rendered by the server, the risk is confined to the internal network or users with web UI access.