Jenkins Sonarqube Scanner Plugin
Monthly
Stored cross-site scripting in Jenkins SonarQube Scanner Plugin ≤2.18.3 allows attackers holding Item/Configure permission to inject javascript: scheme URLs into dashboard links the plugin constructs from SonarQube scanner results. The plugin performs no URL-scheme validation, so a malicious javascript: payload persists in the Jenkins UI and executes in any victim's browser that views or interacts with the affected dashboard link. No public exploit or active exploitation has been identified at time of analysis; the Jenkins security team confirmed and published this issue on 2026-09-02.
Stored cross-site scripting in Jenkins SonarQube Scanner Plugin ≤2.18.3 allows attackers holding Item/Configure permission to inject javascript: scheme URLs into dashboard links the plugin constructs from SonarQube scanner results. The plugin performs no URL-scheme validation, so a malicious javascript: payload persists in the Jenkins UI and executes in any victim's browser that views or interacts with the affected dashboard link. No public exploit or active exploitation has been identified at time of analysis; the Jenkins security team confirmed and published this issue on 2026-09-02.