Executive brief
The Jenkins Gitee Plugin, a popular integration used to trigger builds from Gitee repositories, fails to properly sanitize sender names from webhook payloads. An attacker who can trigger builds through the plugin's webhook can inject malicious scripts that execute in the browsers of Jenkins users viewing build history, potentially compromising user sessions or stealing credentials.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in Jenkins Gitee Plugin version 1301.v8957053c7902 and earlier. The plugin accepts webhook payloads from Gitee push events but does not escape the sender name field before displaying it in build causes and results pages. An attacker with the ability to trigger webhook deliveries (or with a compromised Gitee account) can embed JavaScript in the sender name, which is then stored and executed in the context of any Jenkins user's browser that views the affected build page. The attack requires the ability to create a build via the webhook endpoint but does not require authentication to Jenkins itself. A fix escaping the sender name has been released.
Affected products
- Jenkins Gitee Plugin 1301.v8957053c7902 and earlier
Timeline
- 2026-09-16: disclosed
- 2026-09-16: advisory: Jenkins Security Advisory 2026-09-16