CVE-2026-90488
Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was determined in Xuxueli xxl-job up to 3.4.2. This affects the function GroovyClassLoader.parseClass of the file xxl-job-core/src/main/java/com/xxl/job/core/glue/GlueFactory.java. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
| CWE | CWE-94 CWE-74 |
| Vendor | xuxueli |
| Product | xxl-job |
| Published | Sep 12, 2026 |
| Last Updated | Sep 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for xuxueli xxl-job
Be the first to know when new medium vulnerabilities affecting xuxueli xxl-job are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Xuxueli / xxl-job
3.4.0 3.4.1 3.4.2
References
vuldb.com: https://vuldb.com/vuln/403076 vuldb.com: https://vuldb.com/vuln/403076/cti vuldb.com: https://vuldb.com/cve/CVE-2026-90488 vuldb.com: https://vuldb.com/submit/888470 github.com: https://github.com/zhaizejiang/xxl-job-vuln-poc/blob/main/xxl-job%20v3.4.2%20Remote%20Code%20Execution%20via%20Groovy%20Code%20Execution.md
Credits
🔍 zhaizejiang (VulDB User) VulDB CNA Team