CVE-2026-84673: XSS

Q: What level of access does an attacker need to exploit this issue?

The issue involves overwriting the plugin's appearance configuration through Stapler data binding. The provided information does not specify the exact Jenkins permission or authentication level required.

Q: What is the impact after a malicious icon is configured?

An attacker can configure a custom SVG icon containing inline JavaScript. This results in stored cross-site scripting, so the JavaScript may execute when affected users view the stored icon.

Q: Which plugin versions are affected?

Jenkins Customizable Header Plugin version 295.v2544b_ca_19b_97 and earlier is affected.

Published Sep 2, 2026

Updated

Jenkins Customizable Header Plugin 295.v2544bca19b97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allowing attackers to configure a custom SVG icon containing inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability.

Affected Software

1 affected component

Jenkins Customizable Header Plugin<=295.v2544b_ca_19b_97

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Jenkins Customizable Header Plugin to a version that resolves this vulnerability.
Fixed in 295.v2544b_ca_19b_97

Event History

Sep 2, 2026

CVE Published

via MITRE·03:40 PM

Data Sourced

via MITRE·03:40 PM

Description

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The issue involves overwriting the plugin's appearance configuration through Stapler data binding. The provided information does not specify the exact Jenkins permission or authentication level required.

What is the impact after a malicious icon is configured?

An attacker can configure a custom SVG icon containing inline JavaScript. This results in stored cross-site scripting, so the JavaScript may execute when affected users view the stored icon.

Which plugin versions are affected?