CVE-2026-85076
CriticalCVSS 9.0Summary
Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege in Cronicle can supply undeclared keys in event params through api_create_event, api_update_event, or api_run_event. A key colliding with a security-sensitive environment variable can override the plugin execution context, potentially causing privilege escalation, arbitrary code execution, data access, or service disruption.
Risk Assessment
A low-privileged attacker can execute arbitrary code or access data in the context of child processes, leading to privilege escalation and system compromise.
Recommendation
Update Cronicle to version 0.9.124 or later, which restricts allowed event parameter keys.
Other vulnerabilities in Cronicle
See all- CVE-2026-55562Critical
Cronicle prior to 0.9.119 concatenates the attacker-controlled item.user.full_name value into HTML in the administrator Activity Log (htdocs/js/pages/admin/Activity.js) without applying encode_entities and inserts the result through this.div.html. The bundled pixl-server-user input filter can be bypassed by a tag containing a line break because its regular expression does not match newlines. An authenticated non-administrator can update their own name through /api/user/update, and when free_accounts is enabled an anonymous attacker can plant the name during self-registration. The stored name executes script in an administrator's session when the Activity Log is opened, enabling administrator takeover and subsequent command execution. This issue is fixed in version 0.9.119.
- CVE-2026-58255High
In Cronicle prior to 0.9.121, a non-administrator user or scoped API key with `create_events` and `run_events` privileges can inject top-level `uid` and `gid` fields through `/api/app/create_event` or `/api/app/update_event`. In `lib/api.js`, `requireValidEventData` uses `validateOptionalParams` as a partial allow-list that silently passes unknown keys, storing the injected fields verbatim. In `lib/job.js`, `launchJob` copies the whole event into the job, and a plugin `uid` overrides the event `uid` only when the plugin defines one. The default `shellplug` and `urlplug` plugins do not define a `uid`, so the event-controlled identity survives into child-process launch.
- CVE-2026-39401Medium
Cronicle before version 0.9.111 has a vulnerability where child processes can modify the parent event's configuration via the update_event key in JSON output without any authorization check. This allows a low-privilege user who can create and run events to change any event property, including webhook URLs and notification emails.
- CVE-2026-39400Medium
Cronicle, a multi-server task scheduler, prior to version 0.9.111 allows non-admin users to inject arbitrary JavaScript through job output fields. The server stores data without sanitization, and the client renders it via innerHTML on the Job Details page.
Original NVD description (English source)
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_update_event, or api_run_event. lib/api.js and lib/api/event.js validate the parameter object without restricting its keys, and lib/job.js uppercases those keys and applies them to the child process environment after administrator-defined plugin variables. A key that collides with a security-sensitive environment variable can therefore override the plugin execution context and may cause privilege escalation, arbitrary code execution, data access, or service disruption depending on the plugin and runtime. This issue is fixed in version 0.9.124.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS