Executive brief
The Jenkins buildgraph-view Plugin, which provides a visual representation of build dependencies, contains a security flaw that allows for stored cross-site scripting. An attacker with the ability to configure jobs or views can inject malicious scripts into build URLs. If an unsuspecting user views the affected build graph, the script will execute in their browser, potentially leading to unauthorized actions or data theft within the Jenkins environment.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Jenkins buildgraph-view Plugin versions 1.8 and earlier. The vulnerability is caused by the plugin's failure to sanitize or escape the build URL before rendering it in the user interface. An attacker with 'Low' privileges (specifically the ability to configure jobs or views) can inject malicious JavaScript into the build URL field. When other users navigate to the build graph view, the payload executes within their browser context. As of the advisory publication, no patch is available for this issue.
Affected products
- Jenkins Project buildgraph-view Plugin <= 1.8
Timeline
- 2026-05-27: advisory: Advisory published by Jenkins and NVD