EUVD-2026-80758
GHSA-jv9v-4wvp-mh7g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with Item/Configure permission
-
DeliverySubmit job config via REST API
-
ExploitInject javascript: URL as analysis results ID
-
ExecutionPayload stored unvalidated
-
PersistVictim views analysis results page
-
ImpactScript executes in victim's session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated attacker with Jenkins Item/Configure permission who submits a job configuration through the REST API (the vector that bypasses normal UI validation of the analysis results ID). Exploitation is limited by two factors: the attacker must already hold job-configure privileges (PR:L), and the stored payload only fires when a victim subsequently loads the affected analysis/warnings results page (UI:R) - the injected 'javascript:' scheme identifier executes in that viewer's browser context. Affects Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier; not exploitable against patched builds. |
| Impact | This is a well-scoped, credibly-rated stored XSS. The CVSS 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) reflects Jenkins' standard convention of rating XSS that executes in a victim administrator's authenticated session as full C/I/A:H, since script running in that context can reconfigure jobs, exfiltrate credentials, or trigger builds. However, several signals temper the raw score: PR:L means the attacker already needs a valid account with Item/Configure permission (a moderately trusted role), and UI:R means a victim must actually view the poisoned analysis results page. CISA's SSVC decision framework aligns with this reading - Exploitation: none (no observed activity), Automatable: no (requires per-target account + victim interaction), Technical Impact: total (consistent with the C:H/I:H/A:H). There is no CISA KEV listing, no public POC identified, and no EPSS score in the provided data. Net: this is a legitimate patch-worthy issue for organizations running the plugin with multiple lower-trust users who can configure jobs, but it is not a mass-exploitable, unauthenticated internet-facing bug - the PR:L + UI:R gating plus 'no automatable' SSVC verdict places it below drop-everything urgency. No conflicting signals in the data; the CVSS vector and description agree (network-delivered via REST API, low complexity, needs privilege and interaction). |
| Exploit ScenarioDerived | An attacker holding a Jenkins account with Item/Configure permission submits a job configuration via the REST API, supplying a 'javascript:' scheme URL as the analysis results ID, which is stored without validation. When an administrator or other user later views that job's warnings/analysis results page, the injected script executes in their authenticated session, enabling credential theft or configuration changes. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Stored cross-site scripting in Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier lets an authenticated attacker holding Item/Configure permission inject a javascript: scheme value as the analysis results identifier by submitting a job configuration through the REST API, bypassing the validation that the normal UI path performs. The payload is persisted with the job and executes in the browser of any user who later opens the affected Warnings/analysis results page (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, 8.0, CWE-79). No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none and automatable as no, although technical impact is rated total; vendor patches are available in 13.10259.v80f407cb_03a_e and the backport 13.10223.10225.vcf001b_b_b_3a_90.
RemediationAI
Upgrade the Jenkins Warnings Plugin to version 13.10259.v80f407cb_03a_e (current line) or, if you track the maintenance branch, to 13.10223.10225.vcf001b_b_b_3a_90 - these are vendor-released patches per https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-3937, after which the REST configuration path validates the analysis results ID and the javascript: scheme identifier can no longer be stored. Because exploitation requires Item/Configure permission (CVSS PR:L), interim compensating controls should focus on that privilege: audit and reduce who holds Job/Configure (and generally Item/Configure) in Jenkins, since that permission already permits arbitrary job-configuration changes and is typically granted sparingly - the trade-off is potential disruption to legitimate job owners who can no longer edit pipelines. Additionally, after patching, review existing job configurations for analysis results identifiers containing a javascript: scheme or other unexpected URL schemes and remove them, since the payload is persisted and would otherwise continue to execute for anybody viewing the results page; note that simply browsing the Warnings results page is sufficient to trigger execution (UI:R), so restricting who can view those job pages provides temporary blast-radius reduction at the cost of visibility for other users. There is no public exploit code for this issue at time of analysis, so exposure is currently limited to attackers who already hold configuration privileges on a Jenkins instance, but the patches should still be applied promptly on internet-reachable Jenkins controllers and the advisory reinstalled-plugin note (Jenkins update center) followed.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Jenkins Warnings plugin (CWE-79, improper neutralization of input during web page generation) collects and renders static-analysis results, referencing individual result sets by an "analysis results ID". The plugin's UI path validated that identifier, but the equivalent configuration path reachable through the Jenkins REST API did not re-validate it when a job configuration was submitted, so an attacker could persist a value using the javascript: URL scheme. Because the identifier is stored in the job configuration and later rendered into the Warnings/analysis results view, the flaw is a stored XSS rather than reflected: the injected scheme executes in the browser context of the victim who loads that page. Affected component is identified by CPE cpe:2.3:a:jenkins_project:jenkins_warnings_plugin:*:*:*:*:*:*:*:*; the assessed vector requires network access, low privileges (PR:L, i.e. Item/Configure), and user interaction (UI:R) from the victim viewing the results page, with high confidentiality, integrity and availability impact confined to that viewer's session scope (S:U). Jenkins plugins are distributed via the Jenkins update center and typically carry long version strings with plugin-version encoding, which is why the fix appears in two parallel release lines.
Know when Jenkins Warnings Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Network REST API delivery, low complexity, needs Item/Configure account (PR:L) and a victim view (UI:R); script in an admin session justifies C/I/A:H, S:U per Jenkins convention.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
3DescriptionCVE.org
Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting (XSS) vulnerability.
Articles & Coverage 2
Executive ViewAI
A high-severity stored cross-site scripting flaw in the Jenkins Warnings Plugin allows an authenticated user with job configuration rights to plant persistent malicious script content that later executes in the browsers of anyone viewing the affected analysis results page. Because Jenkins orchestrates software build and deployment pipelines, a compromised developer or administrator session could expose source code, credentials, and release artifacts. Leadership should care because the affected plugin is widely deployed across CI/CD infrastructure, and the flaw can quietly turn trusted engineering staff sessions into a foothold for supply-chain level compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB