AIKIDO-2026-221179
jenkins-core is vulnerable to Cross-Site Scripting (XSS)
88
High Risk
This Affects:
jenkins-coreTL;DR
The system log viewer does not escape log record metadata such as source, level, and timestamp when rendering entries. An attacker who controls an agent process can inject stored script into that metadata so it executes in the browser of anyone who views the system log. The fix escapes log record metadata before display.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and attackers can control agent processes that contribute log records viewed in the system log viewer.
Background info
jenkins-core is vulnerable to Cross-Site Scripting (XSS) in versions 0.0.1 - 2.568.2 and 2.569 - 2.579.
How to fix this
Upgrade the org.jenkins-ci.main:jenkins-core library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.