EUVD-2026-70131
GHSA-cqmc-x8fm-wq36
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker holds Item/Configure permission
-
DeliveryInject javascript: URL into SonarQube scanner configuration
-
ExploitPlugin stores malicious link in Jenkins job dashboard
-
ExecutionVictim views job dashboard in browser
-
Persistjavascript: payload executes in victim's authenticated session
-
ImpactSession token exfiltrated or actions performed as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must hold Item/Configure permission on at least one Jenkins job - a privilege typically granted to CI operators, developers, or pipeline authors in multi-user Jenkins instances. The victim must view or interact with the affected job's dashboard page in a browser session (UI:R). The Jenkins SonarQube Scanner Plugin must be installed and active. Exploitation is bounded by these two conditions: without Item/Configure access there is no write path to the stored payload, and without a victim rendering the dashboard the payload does not execute. Pure administrative-only or single-user Jenkins deployments are at low practical risk. |
| Impact | The provided CVSS 8.0 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) reflects network-accessible, low-complexity exploitation with minimal privilege. The PR:L requirement - Item/Configure permission - is a meaningful but common constraint in shared Jenkins environments where developers regularly hold job-configuration rights. The stored XSS nature elevates real-world risk relative to reflected XSS, since the payload persists and does not require victim interaction beyond viewing a routine dashboard page. The CIA:H/H/H scoring is generous for XSS alone; realistic impact is session token theft and actions-on-behalf-of-victim within Jenkins, which may fully compromise an administrator account if one views the poisoned link. No EPSS score or KEV listing was provided; active exploitation is unconfirmed. No publicly identified POC exists at time of analysis. Real priority is medium-high in multi-user Jenkins deployments where Item/Configure rights are distributed broadly, and low in single-operator or tightly-permissioned installations. |
| Exploit ScenarioDerived | A developer with Item/Configure permission on a Jenkins job configures the SonarQube scanner with a crafted URL value containing a javascript: payload, which the plugin stores as a dashboard link. When a Jenkins administrator later reviews the job's build results page, the malicious link renders in the dashboard; if the administrator hovers or clicks the link, the JavaScript executes in their authenticated browser session, enabling the attacker to exfiltrate the admin's Jenkins session cookie and take over the account. No POC has been publicly identified, but the mechanism is well-understood for this class of vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Stored cross-site scripting in Jenkins SonarQube Scanner Plugin ≤2.18.3 allows attackers holding Item/Configure permission to inject javascript: scheme URLs into dashboard links the plugin constructs from SonarQube scanner results. The plugin performs no URL-scheme validation, so a malicious javascript: payload persists in the Jenkins UI and executes in any victim's browser that views or interacts with the affected dashboard link. No public exploit or active exploitation has been identified at time of analysis; the Jenkins security team confirmed and published this issue on 2026-09-02.
RemediationAI
Upgrade the Jenkins SonarQube Scanner Plugin to the version identified as fixed in the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3989 - the exact patched release version should be confirmed there, as it was not specified in the available data. As a compensating control while patching is scheduled, restrict Item/Configure permission to the smallest set of trusted users via Jenkins role-based access controls, reducing the population of potential attackers. Additionally, enabling Jenkins's built-in Content-Security-Policy (CSP) header (jenkins.model.Jenkins.instance.setCrumbIssuer(null) or via the System Groovy script console) to include script-src 'self' can block inline javascript: execution in many browsers, though this may break other UI functionality and is not a substitute for the upstream fix. The oss-security posting at https://seclists.org/oss-sec/2026/q3/639 provides additional context.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Jenkins SonarQube Scanner Plugin (CPE: cpe:2.3:a:jenkins_project:jenkins_sonarqube_scanner_plugin:*:*:*:*:*:*:*:*) integrates Jenkins CI/CD pipelines with the SonarQube static analysis platform, automatically generating clickable dashboard links from scanner output. The root cause, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), is the absence of URL-scheme allowlisting when constructing those links. Modern browsers execute javascript: URIs as script when placed in href attributes and activated, so an attacker-supplied javascript:alert(document.cookie) or equivalent payload embedded in a scanner-result link is stored server-side and delivered to every Jenkins user who renders that job's dashboard page. The attack surface is the Item/Configure permission boundary: any user granted that right on a job can influence the URL values the plugin stores.
Know when Jenkins Sonarqube Scanner Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
S:C applies because XSS executes in victim's browser security context (scope change from Jenkins app to another user's session); C:L/I:L reflects script-execution-level impact rather than direct system compromise.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
3DescriptionCVE.org
Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the javascript: scheme, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Articles & Coverage 2
Executive ViewAI
Jenkins SonarQube Scanner Plugin versions 2.18.3 and earlier contain a stored cross-site scripting vulnerability that allows authenticated administrators with Item/Configure permission to inject malicious JavaScript into persistent dashboard links, compromising any Jenkins user who views those links. This impacts CI/CD pipeline integrity and poses a risk for credential theft, unauthorized configuration changes, and lateral movement within development infrastructure.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict Item/Configure permission to only trusted administrators, (2) implement Jenkins-level input validation for dashboard URLs, (3) audit and remove all existing suspicious dashboard links from SonarQube scanner results, (4) deploy Content Security Policy headers to block javascript: scheme execution, (5) consider disabling the plugin if not critical to your CI/CD workflow, and (6) monitor Jenkins audit logs for privilege escalation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB