Jenkins Coverage Plugin CVE-2026-92135

Exploitation requires an authenticated Jenkins user who already holds Item/Configure permission on a job, using that access to submit a job configuration through the REST API with a 'javascript:' scheme URL supplied as the coverage results ID (the unvalidated field). Successful payload execution further requires user interaction (UI:R): a victim - typically a more privileged user or administrator - must subsequently view the affected job's coverage page in their browser. These two factors (low-privilege authentication plus required victim interaction) meaningfully limit real-world exploitation, so it is not usable against default unauthenticated Jenkins deployments. Affected: Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier; fixed in 3.3325.3327.v26c59e218691 and 3.3361.v0626103a_67e6.

This is a genuine but conditional vulnerability, not an internet-facing critical. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, score 8.0) shows the high 8.0 is driven by the C:H/I:H/A:H impact triple that Jenkins conventionally assigns to stored XSS in its admin UI, but two real gates temper it: PR:L requires an authenticated attacker who already holds Item/Configure permission on a job, and UI:R requires a victim (typically a higher-privileged user/admin) to view the affected job page. CISA SSVC reinforces the 'not urgent' read: Exploitation=none (no observed activity), Automatable=no (requires per-target authenticated setup and victim interaction), though Technical Impact=total aligns with the C/I/A:H rating because XSS in the Jenkins context can drive CSRF-style actions or credential/session theft leading to full controller compromise. There is no KEV listing, no public POC referenced, and no EPSS score in the input - all three exploitation signals are effectively 'quiet.' Net: prioritize patching for any multi-tenant Jenkins where low-trust users hold Item/Configure, but this is not a mass-exploitation or unauthenticated-RCE emergency. No conflicting signals in the data - the CVSS network vector is consistent with the REST-API-submitted description.

An attacker holding Item/Configure permission on a Jenkins job submits a job configuration via the REST API, supplying a 'javascript:' scheme URL as the coverage results ID, which is stored without validation. When an administrator or other higher-privileged user later opens the affected job/coverage page, the attacker's script executes in their browser session, enabling actions such as CSRF token theft or privileged operations. No public exploit code is referenced in the available data.