EUVD-2026-80758
GHSA-jv9v-4wvp-mh7g
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Network REST API delivery, low complexity, needs Item/Configure account (PR:L) and a victim view (UI:R); script in an admin session justifies C/I/A:H, S:U per Jenkins convention.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
5DescriptionCVE.org
Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting (XSS) vulnerability.
Articles & Coverage 1
AnalysisAI
Stored cross-site scripting in Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier lets an authenticated attacker holding Item/Configure permission inject a javascript: scheme value as the analysis results identifier by submitting a job configuration through the REST API, bypassing the validation that the normal UI path performs. The payload is persisted with the job and executes in the browser of any user who later opens the affected Warnings/analysis results page (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, 8.0, CWE-79). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated attacker with Jenkins Item/Configure permission who submits a job configuration through the REST API (the vector that bypasses normal UI validation of the analysis results ID). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a well-scoped, credibly-rated stored XSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Jenkins Warnings Plugin to version 13.10259.v80f407cb_03a_e (current line) or, if you track the maintenance branch, to 13.10223.10225.vcf001b_b_b_3a_90 - these are vendor-released patches per https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-3937, after which the REST configuration path validates the analysis results ID and the javascript: scheme identifier can no longer be stored. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Jenkins controllers and agents to identify installations running the Warnings Plugin at 13.10258.va_17d49a_78c3b_ or earlier, restrict network access to the Jenkins REST API to trusted management networks only, and audit recent job configuration changes for unexpected javascript: values in analysis results identifiers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today