CVE-2026-92135: XSS
Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting (XSS) vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Jenkins Coverage Pluginto a version that resolves this vulnerability.Fixed in 3.3358.v9487dde48783 - Compensating control
Restrict Item/Configure permissions in Jenkins so untrusted users cannot submit or modify job configurations via the REST API.
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs Item/Configure permission and must be able to submit a job configuration through the REST API. This is not an unauthenticated issue based on the available information.
What conditions make a Jenkins instance affected?
Instances using Jenkins Coverage Plugin version 3.3358.v9487dde48783 or earlier are affected when a user with Item/Configure permission can configure a coverage results ID through the REST API.
What is the impact of successful exploitation?
An attacker can set the coverage results identifier to a javascript: scheme URL, causing stored cross-site scripting. The malicious value is retained and may execute JavaScript when it is later rendered in a browser.