The vulnerability arises from a stored cross‑site scripting flaw in Cronicle's administrator Activity Log. Prior to version 0.9.119 the application concatenates the value of item.user.full_name directly into the page’s HTML without proper entity encoding, enabling an attacker to inject arbitrary JavaScript. The injection originates from the user profile name field, which can be modified by any authenticated non‑administrator or, when free_accounts is enabled, even by an anonymous user during registration. When the injected payload is later displayed to an administrator—whenever the Activity Log is opened—the malicious script executes under the administrator’s browser context, allowing the attacker to hijack the session and execute arbitrary commands through Cronicle’s privileged backend, effectively providing remote code execution.

Affected product is jhuckaby Cronicle, a multi‑server task scheduler. All releases older than version 0.9.119 are vulnerable. No specific sub‑variants or edition distinctions are mentioned; anyone running Cronicle on any supported platform before v0.9.119 should be considered affected.

The CVSS base score of 9 indicates a severe threat. While the EPSS score is not publicly available, the high CVSS combined with the existence of an authenticated path for attackers suggests a non‑negligible exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, but the potential for administrator takeover and command execution makes it a critical issue.