Executive brief
The Jenkins SonarQube Scanner Plugin processes dashboard links from SonarQube scan results without validating URL schemes, allowing attackers to inject malicious JavaScript code. An attacker with job configuration permissions can craft a SonarQube response containing a javascript: URL, which gets stored and executed in the browsers of users viewing the Jenkins dashboard, potentially compromising their accounts or stealing sensitive data.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the Jenkins SonarQube Scanner Plugin versions 2.18.3 and earlier. The plugin creates dashboard links based on SonarQube scanner results without restricting URL schemes, allowing the javascript: scheme to pass through. An attacker with Item/Configure permission can influence SonarQube scan results or configure the plugin to accept crafted results containing javascript: URLs. These malicious links are stored and rendered to users viewing Jenkins dashboards, executing arbitrary JavaScript in their browser context with the user's privileges. The vulnerability requires an attacker to have Item/Configure permission and user interaction (clicking or visiting the dashboard), but the stored nature means the payload persists across sessions.
Affected products
- Jenkins SonarQube Scanner Plugin 2.18.3 and earlier
Timeline
- 2026-09-02: disclosed