Executive brief
Jenkins Coverage Plugin is a widely-used plugin for collecting and reporting code coverage metrics in CI/CD pipelines. Attackers with job configuration permissions can inject malicious JavaScript code through an unvalidated coverage results identifier field in the REST API, which executes in the browsers of anyone viewing the affected job configuration. This allows credential theft, session hijacking, or actions performed on behalf of authenticated Jenkins users.
Technical details
The Coverage Plugin version 3.3358.v9487dde48783 and earlier fails to validate the coverage results ID parameter when job configurations are submitted via the REST API. An attacker with Item/Configure permission can supply a javascript: scheme URL as the identifier value, which is stored without sanitization. When the job configuration is viewed, the malicious URL executes in the context of the viewer's browser session, enabling stored cross-site scripting (XSS). The vulnerability requires Item/Configure permission to exploit but affects all users who subsequently view the affected job. A patch is available in Jenkins Coverage Plugin versions after 3.3358.v9487dde48783.
Affected products
- Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier
Timeline
- 2026-09-16: disclosed