Vulnerability Details CVE-2026-39400
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, a non-admin user with create_events and run_events privileges can inject arbitrary JavaScript through job output fields (html.content, html.title, table.header, table.rows, table.caption). The server stores this data without sanitization, and the client renders it via innerHTML on the Job Details page. This vulnerability is fixed in 0.9.111.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 16.3%
CVSS Severity
CVSS v3 Score 6.1
Products affected by CVE-2026-39400
-
cpe:2.3:a:cronicle:cronicle:0.0.1
-
cpe:2.3:a:cronicle:cronicle:0.0.2
-
cpe:2.3:a:cronicle:cronicle:0.0.3
-
cpe:2.3:a:cronicle:cronicle:0.0.4
-
cpe:2.3:a:cronicle:cronicle:0.0.5
-
cpe:2.3:a:cronicle:cronicle:0.0.6
-
cpe:2.3:a:cronicle:cronicle:0.0.7
-
cpe:2.3:a:cronicle:cronicle:0.0.8
-
cpe:2.3:a:cronicle:cronicle:0.0.9
-
cpe:2.3:a:cronicle:cronicle:0.1.0
-
cpe:2.3:a:cronicle:cronicle:0.1.1
-
cpe:2.3:a:cronicle:cronicle:0.1.2
-
cpe:2.3:a:cronicle:cronicle:0.1.3
-
cpe:2.3:a:cronicle:cronicle:0.1.4
-
cpe:2.3:a:cronicle:cronicle:0.1.5
-
cpe:2.3:a:cronicle:cronicle:0.1.6
-
cpe:2.3:a:cronicle:cronicle:0.1.7
-
cpe:2.3:a:cronicle:cronicle:0.1.8
-
cpe:2.3:a:cronicle:cronicle:0.1.9
-
cpe:2.3:a:cronicle:cronicle:0.2.0
-
cpe:2.3:a:cronicle:cronicle:0.2.1
-
cpe:2.3:a:cronicle:cronicle:0.2.2
-
cpe:2.3:a:cronicle:cronicle:0.2.3
-
cpe:2.3:a:cronicle:cronicle:0.2.4
-
cpe:2.3:a:cronicle:cronicle:0.2.5
-
cpe:2.3:a:cronicle:cronicle:0.5.0
-
cpe:2.3:a:cronicle:cronicle:0.5.1
-
cpe:2.3:a:cronicle:cronicle:0.5.2
-
cpe:2.3:a:cronicle:cronicle:0.5.3
-
cpe:2.3:a:cronicle:cronicle:0.5.4
-
cpe:2.3:a:cronicle:cronicle:0.5.5
-
cpe:2.3:a:cronicle:cronicle:0.5.6
-
cpe:2.3:a:cronicle:cronicle:0.5.7
-
cpe:2.3:a:cronicle:cronicle:0.5.8
-
cpe:2.3:a:cronicle:cronicle:0.6.0
-
cpe:2.3:a:cronicle:cronicle:0.6.1
-
cpe:2.3:a:cronicle:cronicle:0.6.10
-
cpe:2.3:a:cronicle:cronicle:0.6.11
-
cpe:2.3:a:cronicle:cronicle:0.6.12
-
cpe:2.3:a:cronicle:cronicle:0.6.13
-
cpe:2.3:a:cronicle:cronicle:0.6.14
-
cpe:2.3:a:cronicle:cronicle:0.6.15
-
cpe:2.3:a:cronicle:cronicle:0.6.16
-
cpe:2.3:a:cronicle:cronicle:0.6.2
-
cpe:2.3:a:cronicle:cronicle:0.6.3
-
cpe:2.3:a:cronicle:cronicle:0.6.4
-
cpe:2.3:a:cronicle:cronicle:0.6.5
-
cpe:2.3:a:cronicle:cronicle:0.6.6
-
cpe:2.3:a:cronicle:cronicle:0.6.7
-
cpe:2.3:a:cronicle:cronicle:0.6.8
-
cpe:2.3:a:cronicle:cronicle:0.6.9
-
cpe:2.3:a:cronicle:cronicle:0.7.0
-
cpe:2.3:a:cronicle:cronicle:0.7.1
-
cpe:2.3:a:cronicle:cronicle:0.7.2
-
cpe:2.3:a:cronicle:cronicle:0.7.3
-
cpe:2.3:a:cronicle:cronicle:0.7.4
-
cpe:2.3:a:cronicle:cronicle:0.7.5
-
cpe:2.3:a:cronicle:cronicle:0.7.6
-
cpe:2.3:a:cronicle:cronicle:0.7.7
-
cpe:2.3:a:cronicle:cronicle:0.7.8
-
cpe:2.3:a:cronicle:cronicle:0.8.0
-
cpe:2.3:a:cronicle:cronicle:0.8.1
-
cpe:2.3:a:cronicle:cronicle:0.8.10
-
cpe:2.3:a:cronicle:cronicle:0.8.11
-
cpe:2.3:a:cronicle:cronicle:0.8.12
-
cpe:2.3:a:cronicle:cronicle:0.8.13
-
cpe:2.3:a:cronicle:cronicle:0.8.14
-
cpe:2.3:a:cronicle:cronicle:0.8.15
-
cpe:2.3:a:cronicle:cronicle:0.8.16
-
cpe:2.3:a:cronicle:cronicle:0.8.17
-
cpe:2.3:a:cronicle:cronicle:0.8.18
-
cpe:2.3:a:cronicle:cronicle:0.8.19
-
cpe:2.3:a:cronicle:cronicle:0.8.2
-
cpe:2.3:a:cronicle:cronicle:0.8.20
-
cpe:2.3:a:cronicle:cronicle:0.8.21
-
cpe:2.3:a:cronicle:cronicle:0.8.22
-
cpe:2.3:a:cronicle:cronicle:0.8.23
-
cpe:2.3:a:cronicle:cronicle:0.8.24
-
cpe:2.3:a:cronicle:cronicle:0.8.25
-
cpe:2.3:a:cronicle:cronicle:0.8.26
-
cpe:2.3:a:cronicle:cronicle:0.8.27
-
cpe:2.3:a:cronicle:cronicle:0.8.28
-
cpe:2.3:a:cronicle:cronicle:0.8.29
-
cpe:2.3:a:cronicle:cronicle:0.8.3
-
cpe:2.3:a:cronicle:cronicle:0.8.30
-
cpe:2.3:a:cronicle:cronicle:0.8.31
-
cpe:2.3:a:cronicle:cronicle:0.8.32
-
cpe:2.3:a:cronicle:cronicle:0.8.33
-
cpe:2.3:a:cronicle:cronicle:0.8.34
-
cpe:2.3:a:cronicle:cronicle:0.8.35
-
cpe:2.3:a:cronicle:cronicle:0.8.36
-
cpe:2.3:a:cronicle:cronicle:0.8.37
-
cpe:2.3:a:cronicle:cronicle:0.8.38
-
cpe:2.3:a:cronicle:cronicle:0.8.39
-
cpe:2.3:a:cronicle:cronicle:0.8.4
-
cpe:2.3:a:cronicle:cronicle:0.8.40
-
cpe:2.3:a:cronicle:cronicle:0.8.41
-
cpe:2.3:a:cronicle:cronicle:0.8.42
-
cpe:2.3:a:cronicle:cronicle:0.8.43
-
cpe:2.3:a:cronicle:cronicle:0.8.44
-
cpe:2.3:a:cronicle:cronicle:0.8.45
-
cpe:2.3:a:cronicle:cronicle:0.8.46
-
cpe:2.3:a:cronicle:cronicle:0.8.47
-
cpe:2.3:a:cronicle:cronicle:0.8.48
-
cpe:2.3:a:cronicle:cronicle:0.8.49
-
cpe:2.3:a:cronicle:cronicle:0.8.5
-
cpe:2.3:a:cronicle:cronicle:0.8.50
-
cpe:2.3:a:cronicle:cronicle:0.8.51
-
cpe:2.3:a:cronicle:cronicle:0.8.52
-
cpe:2.3:a:cronicle:cronicle:0.8.53
-
cpe:2.3:a:cronicle:cronicle:0.8.54
-
cpe:2.3:a:cronicle:cronicle:0.8.55
-
cpe:2.3:a:cronicle:cronicle:0.8.56
-
cpe:2.3:a:cronicle:cronicle:0.8.57
-
cpe:2.3:a:cronicle:cronicle:0.8.58
-
cpe:2.3:a:cronicle:cronicle:0.8.59
-
cpe:2.3:a:cronicle:cronicle:0.8.6
-
cpe:2.3:a:cronicle:cronicle:0.8.60
-
cpe:2.3:a:cronicle:cronicle:0.8.61
-
cpe:2.3:a:cronicle:cronicle:0.8.62
-
cpe:2.3:a:cronicle:cronicle:0.8.7
-
cpe:2.3:a:cronicle:cronicle:0.8.8
-
cpe:2.3:a:cronicle:cronicle:0.8.9
-
cpe:2.3:a:cronicle:cronicle:0.9.0
-
cpe:2.3:a:cronicle:cronicle:0.9.1
-
cpe:2.3:a:cronicle:cronicle:0.9.10
-
cpe:2.3:a:cronicle:cronicle:0.9.100
-
cpe:2.3:a:cronicle:cronicle:0.9.101
-
cpe:2.3:a:cronicle:cronicle:0.9.102
-
cpe:2.3:a:cronicle:cronicle:0.9.103
-
cpe:2.3:a:cronicle:cronicle:0.9.104
-
cpe:2.3:a:cronicle:cronicle:0.9.105
-
cpe:2.3:a:cronicle:cronicle:0.9.106
-
cpe:2.3:a:cronicle:cronicle:0.9.107
-
cpe:2.3:a:cronicle:cronicle:0.9.108
-
cpe:2.3:a:cronicle:cronicle:0.9.109
-
cpe:2.3:a:cronicle:cronicle:0.9.11
-
cpe:2.3:a:cronicle:cronicle:0.9.110
-
cpe:2.3:a:cronicle:cronicle:0.9.12
-
cpe:2.3:a:cronicle:cronicle:0.9.13
-
cpe:2.3:a:cronicle:cronicle:0.9.14
-
cpe:2.3:a:cronicle:cronicle:0.9.15
-
cpe:2.3:a:cronicle:cronicle:0.9.16
-
cpe:2.3:a:cronicle:cronicle:0.9.17
-
cpe:2.3:a:cronicle:cronicle:0.9.18
-
cpe:2.3:a:cronicle:cronicle:0.9.19
-
cpe:2.3:a:cronicle:cronicle:0.9.2
-
cpe:2.3:a:cronicle:cronicle:0.9.20
-
cpe:2.3:a:cronicle:cronicle:0.9.21
-
cpe:2.3:a:cronicle:cronicle:0.9.22
-
cpe:2.3:a:cronicle:cronicle:0.9.23
-
cpe:2.3:a:cronicle:cronicle:0.9.24
-
cpe:2.3:a:cronicle:cronicle:0.9.25
-
cpe:2.3:a:cronicle:cronicle:0.9.26
-
cpe:2.3:a:cronicle:cronicle:0.9.27
-
cpe:2.3:a:cronicle:cronicle:0.9.28
-
cpe:2.3:a:cronicle:cronicle:0.9.29
-
cpe:2.3:a:cronicle:cronicle:0.9.3
-
cpe:2.3:a:cronicle:cronicle:0.9.30
-
cpe:2.3:a:cronicle:cronicle:0.9.31
-
cpe:2.3:a:cronicle:cronicle:0.9.32
-
cpe:2.3:a:cronicle:cronicle:0.9.33
-
cpe:2.3:a:cronicle:cronicle:0.9.34
-
cpe:2.3:a:cronicle:cronicle:0.9.35
-
cpe:2.3:a:cronicle:cronicle:0.9.36
-
cpe:2.3:a:cronicle:cronicle:0.9.37
-
cpe:2.3:a:cronicle:cronicle:0.9.38
-
cpe:2.3:a:cronicle:cronicle:0.9.39
-
cpe:2.3:a:cronicle:cronicle:0.9.4
-
cpe:2.3:a:cronicle:cronicle:0.9.40
-
cpe:2.3:a:cronicle:cronicle:0.9.41
-
cpe:2.3:a:cronicle:cronicle:0.9.42
-
cpe:2.3:a:cronicle:cronicle:0.9.43
-
cpe:2.3:a:cronicle:cronicle:0.9.44
-
cpe:2.3:a:cronicle:cronicle:0.9.45
-
cpe:2.3:a:cronicle:cronicle:0.9.46
-
cpe:2.3:a:cronicle:cronicle:0.9.47
-
cpe:2.3:a:cronicle:cronicle:0.9.48
-
cpe:2.3:a:cronicle:cronicle:0.9.49
-
cpe:2.3:a:cronicle:cronicle:0.9.5
-
cpe:2.3:a:cronicle:cronicle:0.9.50
-
cpe:2.3:a:cronicle:cronicle:0.9.51
-
cpe:2.3:a:cronicle:cronicle:0.9.52
-
cpe:2.3:a:cronicle:cronicle:0.9.53
-
cpe:2.3:a:cronicle:cronicle:0.9.54
-
cpe:2.3:a:cronicle:cronicle:0.9.55
-
cpe:2.3:a:cronicle:cronicle:0.9.56
-
cpe:2.3:a:cronicle:cronicle:0.9.57
-
cpe:2.3:a:cronicle:cronicle:0.9.58
-
cpe:2.3:a:cronicle:cronicle:0.9.59
-
cpe:2.3:a:cronicle:cronicle:0.9.6
-
cpe:2.3:a:cronicle:cronicle:0.9.60
-
cpe:2.3:a:cronicle:cronicle:0.9.61
-
cpe:2.3:a:cronicle:cronicle:0.9.62
-
cpe:2.3:a:cronicle:cronicle:0.9.63
-
cpe:2.3:a:cronicle:cronicle:0.9.64
-
cpe:2.3:a:cronicle:cronicle:0.9.65
-
cpe:2.3:a:cronicle:cronicle:0.9.66
-
cpe:2.3:a:cronicle:cronicle:0.9.67
-
cpe:2.3:a:cronicle:cronicle:0.9.68
-
cpe:2.3:a:cronicle:cronicle:0.9.69
-
cpe:2.3:a:cronicle:cronicle:0.9.7
-
cpe:2.3:a:cronicle:cronicle:0.9.70
-
cpe:2.3:a:cronicle:cronicle:0.9.71
-
cpe:2.3:a:cronicle:cronicle:0.9.72
-
cpe:2.3:a:cronicle:cronicle:0.9.73
-
cpe:2.3:a:cronicle:cronicle:0.9.74
-
cpe:2.3:a:cronicle:cronicle:0.9.75
-
cpe:2.3:a:cronicle:cronicle:0.9.76
-
cpe:2.3:a:cronicle:cronicle:0.9.77
-
cpe:2.3:a:cronicle:cronicle:0.9.78
-
cpe:2.3:a:cronicle:cronicle:0.9.79
-
cpe:2.3:a:cronicle:cronicle:0.9.8
-
cpe:2.3:a:cronicle:cronicle:0.9.80
-
cpe:2.3:a:cronicle:cronicle:0.9.81
-
cpe:2.3:a:cronicle:cronicle:0.9.82
-
cpe:2.3:a:cronicle:cronicle:0.9.83
-
cpe:2.3:a:cronicle:cronicle:0.9.84
-
cpe:2.3:a:cronicle:cronicle:0.9.85
-
cpe:2.3:a:cronicle:cronicle:0.9.86
-
cpe:2.3:a:cronicle:cronicle:0.9.87
-
cpe:2.3:a:cronicle:cronicle:0.9.88
-
cpe:2.3:a:cronicle:cronicle:0.9.89
-
cpe:2.3:a:cronicle:cronicle:0.9.9
-
cpe:2.3:a:cronicle:cronicle:0.9.90
-
cpe:2.3:a:cronicle:cronicle:0.9.91
-
cpe:2.3:a:cronicle:cronicle:0.9.92
-
cpe:2.3:a:cronicle:cronicle:0.9.93
-
cpe:2.3:a:cronicle:cronicle:0.9.94
-
cpe:2.3:a:cronicle:cronicle:0.9.95
-
cpe:2.3:a:cronicle:cronicle:0.9.96
-
cpe:2.3:a:cronicle:cronicle:0.9.97
-
cpe:2.3:a:cronicle:cronicle:0.9.98
-
cpe:2.3:a:cronicle:cronicle:0.9.99