CVE-2026-84677: XSS
Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and version metadata) on plugin download index pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.18.3 - Compensating control
Restrict who can upload/provide plugins for hosting so attackers cannot supply plugin names/descriptions/version metadata that get rendered on Jenkins plugin download index pages.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to provide a plugin for hosting, because the vulnerable pages render plugin-provided names, descriptions, or version metadata without escaping them.
Which deployments are affected?
Jenkins update-center2 version 3.18.3 and earlier is affected. The provided information does not state whether any particular hosting configuration is enabled by default.
How can I determine whether a hosted plugin may be carrying a payload?
Review plugin names, descriptions, and version metadata displayed on plugin download index pages, especially for plugins supplied by untrusted or newly added hosting sources. The issue is triggered by unescaped values in those fields.