MEDIUM

CVE-2026-90488

2026-09-13 CVSS v3.1

CVSS

6.3

Description

A vulnerability was determined in Xuxueli xxl-job up to 3.4.2. This affects the function GroovyClassLoader.parseClass of the file xxl-job-core/src/main/java/com/xxl/job/core/glue/GlueFactory.java. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Weakness (CWE)

CWE-74 Injection

CWE-94 Code Injection

EPSS Score

0.23%

Probability of exploitation in next 30 days

13.8th percentile

References

https://github.com/zhaizejiang/xxl-job-vuln-poc/blob/main/xxl-job%20v3.4.2%20Remote%20Code%20Execution%20via%20Groovy%20Code%20Execution.md https://vuldb.com/cve/CVE-2026-90488 https://vuldb.com/submit/888470 https://vuldb.com/vuln/403076 https://vuldb.com/vuln/403076/cti

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE