Jenkins update-center2: unescaped plugin metadata gives stored XSS on plugin download index pages

Impact

update-center2 generates the plugin download index that Jenkins controllers and their operators fetch from. It does not escape plugin-supplied names, descriptions or version metadata, so anyone who can get a plugin hosted there lands stored JavaScript on those pages, executing in the browser of whoever browses the index - typically the person administering a controller. Jenkins scores it scope-changed, reflecting that the script runs against a different origin than the one hosting it. This is only relevant to operators who run their own internal update center or plugin mirror for an air-gapped or curated fleet; if you consume the public update center as a client, you are not running the affected software. The exposure is against the human browsing the catalogue, not against the controllers pulling plugin JSON from it.

Who can reach it

Remote authenticated attacker able to submit a plugin for hosting on the update center (PR:L), plus user interaction - a victim must load the generated download page in a browser.

What to do

Upgrade update-center2 past 3.18.3 per SECURITY-4038 in the 2026-09-02 Jenkins advisory; the advisory names 3.18.3 and earlier as affected and does not state a fixed release number, so take the current version. This is the site-generation tooling, not a Jenkins controller plugin: regenerate and republish the index after upgrading. No GPU node, agent or controller needs to be drained or restarted. Operators who do not host their own update center have nothing to do here.

References

Related entries

• CloudNativePG instance manager (status server, TCP/8000 control endpoints): A set of operator-only control endpointsNCVD-2026-050-cloudnativepg-instance-manager-s · CloudNativePG instance manager (status server, TCP/8000 control endpoints)Medium
• Slurm (user_name / gid field handling): Slurm trusts the user_name and gid fields carried in job RPCs instead ofCVE-2018-10995 · Slurm (user_name / gid field handling)Medium
• IBM Spectrum LSF (job submission, file permissions): Weak file permissions in the LSF install let a local user changeCVE-2018-1724 · IBM Spectrum LSF (job submission, file permissions)Medium
• AMD IOMMU host buffer access - insufficient RMP checks (AMD-SB-3016): Insufficient RMP checking on IOMMU host bufferCVE-2023-20585 · AMD IOMMU host buffer access - insufficient RMP checks (AMD-SB-3016)Medium
• ZKTeco BioAccess IVS v3.3.1 access control platform: An unauthenticated attacker can open and close any doorCVE-2023-38958 · ZKTeco BioAccess IVS v3.3.1 access control platformMedium
• Intel Data Center GPU Flex Series - Windows driver software: Improper access control in the Flex Series Windows driverCVE-2024-43101 · Intel Data Center GPU Flex Series - Windows driver softwareMedium