EUVD-2026-70146
GHSA-hq87-q544-6grj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
PR:L for required authenticated access; UI:R because a victim must browse a Jenkins page; S:C because the attacker's script executes in victim browser scope.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
4DescriptionCVE.org
Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allowing attackers to configure a custom SVG icon containing inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability.
Articles & Coverage 2
AnalysisAI
Stored cross-site scripting in Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows authenticated attackers with permission to modify plugin appearance settings to inject persistent JavaScript payloads via a crafted SVG icon, executing in the browser context of any Jenkins user who loads the affected header. Because the header renders on every Jenkins page, a single write operation by a low-privileged attacker broadly affects all platform users, including administrators. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a Jenkins account with at least 'Overall/Read' and permission to submit configuration changes to the Customizable Header Plugin - typically any authenticated user can trigger Stapler binding if the configuration endpoint is not access-controlled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U) reflects a low-complexity network attack requiring only authenticated access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the patched version of the Customizable Header Plugin released in conjunction with the vendor advisory at https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-4104. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: restrict write access to Jenkins plugin configuration settings to only the most essential administrators; audit all users and service accounts with plugin modification permissions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today