CVE-2026-58255

Cronicle prior to 0.9.119 concatenates the attacker-controlled item.user.full_name value into HTML in the administrator Activity Log (htdocs/js/pages/admin/Activity.js) without applying encode_entities and inserts the result through this.div.html. The bundled pixl-server-user input filter can be bypassed by a tag containing a line break because its regular expression does not match newlines. An authenticated non-administrator can update their own name through /api/user/update, and when free_accounts is enabled an anonymous attacker can plant the name during self-registration. The stored name executes script in an administrator's session when the Activity Log is opened, enabling administrator takeover and subsequent command execution. This issue is fixed in version 0.9.119.

Cronicle before version 0.9.111 has a vulnerability where child processes can modify the parent event's configuration via the update_event key in JSON output without any authorization check. This allows a low-privilege user who can create and run events to change any event property, including webhook URLs and notification emails.

Cronicle, a multi-server task scheduler, prior to version 0.9.111 allows non-admin users to inject arbitrary JavaScript through job output fields. The server stores data without sanitization, and the client renders it via innerHTML on the Job Details page.