What is the CVSS score of CVE-2026-48927?

CVE-2026-48927 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Jenkins buildgraph-view Plugin CVE-2026-48927

EUVD-2026-32518 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 jenkinsci-cert@googlegroups.com

GHSA-43ph-42gv-7965

XSS Jenkins

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:11 vuln.today

DescriptionCVE.org

Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs or views.

AnalysisAI

Stored cross-site scripting in Jenkins buildgraph-view Plugin 1.8 and earlier allows authenticated attackers with job or view configuration privileges to inject persistent malicious scripts via an unescaped build URL. Any Jenkins user who subsequently views the affected build graph page triggers execution of the attacker-controlled script in their browser context. No active exploitation is confirmed (not in CISA KEV) and no public exploit code is known; SSVC rates exploitation status as none with partial technical impact.

Technical ContextAI

The buildgraph-view Plugin provides a visual pipeline/dependency graph for Jenkins builds. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the failure to HTML-encode the build URL before rendering it in the build graph view's DOM. Because the URL is stored as part of the job or view configuration and later reflected into page output without escaping, a crafted value can break out of the intended HTML context and inject arbitrary script. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U) precisely maps to this stored XSS pattern: network-reachable, low attack complexity, requires low-privilege authenticated access to configure the job/view, and requires a second victim user to load the page. Affected versions span the full release history from 0 through 1.8 inclusive, per ENISA EUVD-2026-32518.

RemediationAI

Upgrade the Jenkins buildgraph-view Plugin to a version newer than 1.8 by consulting the Jenkins Plugin Manager or the official advisory at https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3486. An exact patched version number was not confirmed in the available input data - the advisory should be reviewed directly to identify the specific fixed release. As a compensating control prior to patching, restrict job configuration and view configuration permissions (in Jenkins' role-based access control or matrix authorization) to only fully trusted users, since PR:L is a hard prerequisite for exploitation; this limits the attacker pool to highly privileged accounts and reduces realistic risk substantially. If the buildgraph-view Plugin is not actively used in your environment, disabling or uninstalling it entirely eliminates the attack surface with no functional side effects.