Jenkins EUVD-2026-112186

Exploitation requires the attacker to be in control of an agent process (a malicious or compromised build agent) whose workspace is browsed via the controller's workspace browser, and requires a controller user to actually open that workspace browser view for the resulting stored XSS to fire. It applies only when a job's workspace is located on an agent (not on the controller itself). Limiting factors: the attacker must already hold agent control rather than mere anonymous or low-privilege web access; victim interaction (viewing the workspace browser) is needed; and on Jenkins 2.539+/LTS 2.541.1+ with Content Security Policy protection enforced, the vendor states the known impact is mitigated. Affected: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier; fixed in 2.588 and LTS 2.580.2.

No CVSS vector is provided in any source (the Jenkins advisory and NVD-style fields both show CVSS/CWE as N/A), so severity cannot be anchored to attack-vector/complexity/privilege metrics from the input - the Jenkins advisory itself rates the parent batch items only as qualitative 'High' for other CVEs and gives no rating excerpt for SECURITY-4232. There is no EPSS score, no CISA KEV listing, and no PoC or exploit reference in the provided data; the vuln.today Decision label is 'awaiting_data', which explicitly signals that priority-scoring inputs are incomplete rather than that the issue is urgent. The defining constraint is the prerequisite stated in the description: exploitation requires an attacker who is already 'in control of agent processes' - i.e., a compromised or attacker-operated build agent - which is a meaningfully privileged starting position, not anonymous network access. The impact is a stored cross-site scripting vulnerability in the controller's workspace browser (the agent computes the per-file link URL), so the realistic consequence is script execution in the browser session of a controller user who views that workspace, not direct controller RCE. Net assessment: this is a lower-tier, conditional issue within a larger multi-CVE Jenkins advisory - real and worth patching, but gated behind agent control and further mitigated by Content Security Policy on supported versions; absent CVSS, EPSS, KEV, and PoC data, treat the raw severity as unconfirmed and prioritize the RCE-class items in the same advisory (e.g., CVE-2026-117612/117614) ahead of it.

An attacker who controls a build agent (a rogue agent, or one compromised via another flaw) causes that agent to return file or directory entries whose names/URLs embed a malicious script payload. When a legitimate Jenkins user opens the workspace browser for that agent-hosted job on the controller, the attacker-computed link is rendered and the script executes in the victim's authenticated session. No public exploit code or PoC reference is present in the provided data.