Executive brief
Jenkins update-center2, a component responsible for publishing plugin download indexes, fails to properly escape plugin-provided metadata (names, descriptions, and version information) when displaying them on web pages. Attackers who control a plugin being hosted can inject malicious JavaScript code that executes in the browsers of users viewing the plugin index, potentially stealing credentials or redirecting users to malicious sites.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in Jenkins update-center2 arising from insufficient output encoding of user-controlled plugin metadata. The vulnerable component displays plugin names, descriptions, and version metadata on plugin download index pages without properly escaping HTML special characters. An attacker able to provide a plugin for hosting (requires compromised or malicious plugin submission) can inject JavaScript payloads into these fields that execute in the browser context of anyone viewing the plugin index. The vulnerability is stored, meaning the payload persists and affects all subsequent viewers. No user interaction beyond viewing the page is required from the victim's perspective, though the attacker must have plugin submission privileges.
Affected products
- Jenkins update-center2 3.18.3 and earlier
Timeline
- 2026-09-02: disclosed