EUVD-2026-80764
GHSA-3h9w-3jjf-qw2v
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Stored XSS executes in a victim operator's browser (S:C, C:L/I:L, A:N); reaching the webhook needs some access (PR:L) and a user must view the page (UI:R).
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
2DescriptionCVE.org
Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint.
AnalysisAI
Stored cross-site scripting (XSS) in the Jenkins Gitee Plugin (versions up to and including 1301.v8957053c7902) allows an authenticated attacker who can trigger builds via the plugin's push webhook and control the sender name field to inject malicious JavaScript into build causes, which executes when a Jenkins user views the affected build's causes page. The vulnerability requires the plugin's webhook endpoint to be reachable and a user to subsequently view the build page (UI:R). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an attacker able to reach and trigger the Jenkins Gitee Plugin's push webhook endpoint (the plugin must be installed and its webhook exposed) and control the Gitee push payload's sender name field. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a stored XSS (CWE-79) in the Jenkins Gitee Plugin scored 6.8 by the vendor using the Jenkins boilerplate vector AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the fixed version of the Jenkins Gitee Plugin as specified in the Jenkins security advisory (https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-4027). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Jenkins Gitee Plugin
View allCross-site request forgery in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows network-accessible attackers
Missing permission checks in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allow any authenticated user holding
Credential ID enumeration in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows authenticated attackers holdi
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today