AIKIDO-2026-24862
sonar is vulnerable to Cross-Site Scripting (XSS)
88
High Risk
This Affects:
sonarTL;DR
SonarQube Scanner Plugin allows javascript: URLs in dashboard links derived from scanner results. Attackers with Item/Configure permission can persist script URLs that execute when rendered, resulting in stored cross-site scripting. The fix restricts dashboard URL schemes to http and https and stops rendering persisted disallowed schemes.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and users with Item/Configure permission can control SonarQube scanner result links.
Background info
sonar is vulnerable to Cross-Site Scripting (XSS) in versions 0.0.1 - 2.18.3.
How to fix this
Upgrade the org.jenkins-ci.plugins:sonar library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.