Executive brief
The OWASP Dependency-Check Plugin for Jenkins, a popular automation server used by development teams to scan for vulnerable dependencies, fails to properly escape malicious code in security vulnerability reports. An attacker with permission to configure Jenkins jobs can inject malicious scripts into these reports, which then execute in the browsers of any Jenkins user viewing the results—potentially leading to account compromise or credential theft.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the OWASP Dependency-Check Plugin versions 5.6.4 and earlier. The plugin fails to HTML-escape CWE (Common Weakness Enumeration) values retrieved from Dependency-Check security reports before rendering them on the Jenkins web UI. An attacker with Item/Configure permission can craft malicious CWE entries that, when processed by the plugin, inject executable JavaScript into the Jenkins interface. This stored XSS payload persists in the job configuration and executes each time the report is viewed, affecting all users with permission to see the job. The attack requires prior authentication and Item/Configure permission on the target Jenkins instance.
Affected products
- OWASP Dependency-Check Plugin 5.6.4 and earlier
Timeline
- 2026-09-16: disclosed: CVE-2026-92136 published in Jenkins Security Advisory 2026-09-16