CVE-2026-84665: XSS

Q: Who can exploit this issue?

An attacker needs Item/Configure permission in Jenkins so they can influence SonarQube scanner results that are used to create dashboard links. The vulnerability is stored XSS, so the malicious link can later execute in a victim's browser when it is rendered.

Q: Which plugin versions are affected?

Jenkins SonarQube Scanner Plugin version 2.18.3 and earlier are affected.

Q: What input causes the XSS condition?

The plugin creates dashboard links from SonarQube scanner results without restricting URL schemes. A crafted link using the javascript: scheme can therefore be stored and executed when used in the Jenkins interface.

Published Sep 2, 2026

Updated

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the javascript: scheme, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Affected Software

1 affected component

Jenkins SonarQube Scanner Plugin<=2.18.3

Event History

Sep 2, 2026

CVE Published

via MITRE·03:40 PM

Data Sourced

via MITRE·03:40 PM

Description

Frequently Asked Questions

Who can exploit this issue?

An attacker needs Item/Configure permission in Jenkins so they can influence SonarQube scanner results that are used to create dashboard links. The vulnerability is stored XSS, so the malicious link can later execute in a victim's browser when it is rendered.

Which plugin versions are affected?

Jenkins SonarQube Scanner Plugin version 2.18.3 and earlier are affected.

What input causes the XSS condition?

The plugin creates dashboard links from SonarQube scanner results without restricting URL schemes. A crafted link using the javascript: scheme can therefore be stored and executed when used in the Jenkins interface.