EUVD-2026-26226
GHSA-f8h4-46xv-h7jj
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Stored cross-site scripting in Jenkins HTML Publisher Plugin (versions 427 and earlier) lets an attacker with Item/Configure permission inject JavaScript via an unescaped job name and URL written into the legacy wrapper file, which then executes in the browser of any user who later views the published report. There is no public exploit identified at time of analysis and EPSS is very low (0.04%, 12th percentile), but the SSVC technical impact is rated total, meaning a successful payload can fully compromise a victim session such as an administrator's.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Jenkins Html Publisher Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (jenkins) · only source for this CVE.
CVSS VectorVendor: jenkins
Lifecycle Timeline
2DescriptionCVE.org
Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Executive ViewAI
Jenkins HTML Publisher Plugin versions 427 and earlier contain a stored cross-site scripting vulnerability that allows authenticated users with job configuration permissions to inject malicious scripts into published reports, potentially compromising the sessions of Jenkins administrators and other users who access these reports. This directly threatens CI/CD pipeline integrity, build security, and administrative access control. Organizations using affected plugin versions must patch immediately to prevent unauthorized access to Jenkins administrative functions.
Within 24 hours: Identify all Jenkins instances running HTML Publisher Plugin version 427 or earlier and document their locations and versions; alert Jenkins administrators and begin testing the patch in a staging environment. Within 7 days: Apply the available vendor patch to upgrade HTML Publisher Plugin to the latest patched version across all production and non-production Jenkins instances, coordinating deployment during maintenance windows to minimize pipeline disruption. Within 30 days: Audit published report archives for injected malicious content or suspicious JavaScript, review Jenkins access logs from the previous 90 days for unauthorized Item/Configure permission usage, and verify Content Security Policy (CSP) headers are configured on the Jenkins web server to provide defense-in-depth against similar XSS attacks.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB