Database/Control plane, storage & DevOps
Jenkins HTML Publisher Plugin: job name and URL unescaped in the legacy wrapper, giving stored XSS
Impact
Versions 427 and earlier do not escape the job name or URL written into the legacy wrapper file, so a user who can configure a job stores script that runs in the browser of anyone who later views the published report. On a build controller that deploys to a GPU fleet, the viewer is usually an administrator, and script in their session can reach the Jenkins API with their rights - credentials, job definitions, and the pipelines that push images and drivers to nodes. The exposure is bounded by who already holds Item/Configure: this is a privilege escalation path inside the controller, not an unauthenticated entry point.
Who can reach it
An authenticated Jenkins user holding Item/Configure permission. A second user must then open the published HTML report for the payload to fire.
What to do
Update the HTML Publisher Plugin past 427 per the Jenkins security advisory and restart the controller; the advisory is the authority on the fixed version, which the record does not state. If an update has to wait, tighten Item/Configure membership and treat existing published reports from untrusted job authors as suspect. Nothing on the GPU nodes themselves changes.
References
Related entries
- Progress Kemp LoadMaster Multi Tenant: The Multi Tenant product line's REST API doesn't check whether a caller'sCVE-2026-59690 · Progress Kemp LoadMaster Multi TenantHigh
- Jenkins SonarQube Scanner Plugin: unrestricted URL scheme in dashboard links causes stored XSSCVE-2026-84665 · Jenkins SonarQube Scanner Plugin (dashboard link generation)High
- Jenkins Script Security Plugin (classpath entry approval): Script Security normally requires an administrator toCVE-2026-92127 · Jenkins Script Security Plugin (classpath entry approval)High
- Jenkins Warnings Plugin: unvalidated analysis results ID allows stored XSS in the controller UICVE-2026-92134 · Jenkins Warnings Plugin (analysis results ID validation)High
- Jenkins Coverage Plugin: unvalidated coverage results ID allows stored XSS in the controller UICVE-2026-92135 · Jenkins Coverage Plugin (coverage results ID validation)High
- Jenkins OWASP Dependency-Check Plugin: CWE values from reports are rendered unescaped, giving stored XSSCVE-2026-92136 · Jenkins OWASP Dependency-Check Plugin (report CWE rendering)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.