---
id: CVE-2026-55562
title: >-
  Cronicle is a multi-server task scheduler and runner, with a web based
  front-end UI
summary: >-
  Cronicle is a multi-server task scheduler and runner, with a web based
  front-end UI. Prior to 0.9.119, the administrator Activity Log in
  htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled
  item.user.full_name value int…
severity: critical
cvss: 9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H'
cwe:
  - CWE-79
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T17:17:42.040'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55562'
references:
  - url: >-
      https://github.com/jhuckaby/Cronicle/commit/8b60eb5b041614ab661df50e58e612f5e42a7d30
    label: security-advisories@github.com
  - url: 'https://github.com/jhuckaby/Cronicle/releases/tag/v0.9.119'
    label: security-advisories@github.com
  - url: >-
      https://github.com/jhuckaby/Cronicle/security/advisories/GHSA-vh39-3pcm-2j63
    label: security-advisories@github.com
tags:
  - nvd
ingestedAt: '2026-10-13T17:38:53.196Z'
---

## Overview

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.full_name value into HTML without applying encode_entities and inserts the result through this.div.html. The bundled pixl-server-user input filter can be bypassed by a tag containing a line break because its regular expression does not match newlines. An authenticated non-administrator can update the attacker's own name through /api/user/update using a valid session and current password; when free_accounts is enabled, an anonymous attacker can instead plant the name during self-registration. The stored name executes script in an administrator's session when the Activity Log is opened, enabling administrator takeover and subsequent command execution through privileged Cronicle features. This issue is fixed in version 0.9.119.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.