Executive brief
The Jenkins Warnings Plugin, a widely-used tool for analyzing and reporting code quality issues in CI/CD pipelines, fails to validate the analysis results ID parameter when job configurations are submitted via REST API. An attacker with permission to configure jobs can inject a malicious javascript: scheme URL that executes in the browsers of users viewing the job configuration, potentially stealing credentials or performing actions on their behalf.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Warnings Plugin version 13.10258.va_17d49a_78c3b_ and earlier. When a job configuration is submitted through the REST API, the plugin does not sanitize or validate the analysis results ID field, allowing an attacker with Item/Configure permission to inject a javascript: scheme URL. This payload is stored persistently and executed whenever the configuration is viewed, affecting all users who access the job. No special preconditions beyond the Item/Configure permission are required. A fix is available in newer versions of the plugin.
Affected products
- Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier
Timeline
- 2026-09-16: disclosed