CVE-2026-92134: XSS
Jenkins Warnings Plugin 13.10258.va17d49a78c3b and earlier does not validate the analysis results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting (XSS) vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Jenkins Warnings Pluginto a version that resolves this vulnerability.Fixed in 13.10258.va_17d49a_78c3b_ - Compensating control
Restrict access to the Jenkins REST API endpoint that allows job configuration submission (e.g., limit Item/Configure permission) to prevent untrusted users from submitting the malicious identifier via REST.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs Item/Configure permission and must be able to submit a job configuration through the REST API. This is therefore primarily relevant where untrusted or insufficiently trusted users can configure Jenkins jobs.
What input is used to trigger the XSS?
The attacker can set an analysis results ID to an identifier using a javascript: scheme URL. The vulnerable plugin stores this value, resulting in stored cross-site scripting.
Which plugin versions are affected?
Jenkins Warnings Plugin version 13.10258.va_17d49a_78c3b_ and earlier are affected.