CVE-2026-92136: XSS
Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Jenkins OWASP Dependency-Check Pluginto a version that resolves this vulnerability.Fixed in 5.6.4
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs Item/Configure permission to configure an affected Jenkins item and supply a Dependency-Check report containing crafted CWE values.
Where does the malicious content appear?
The crafted CWE values are stored from Dependency-Check reports and rendered without escaping in the Jenkins UI, creating a stored XSS condition.
How can I determine whether an instance is affected?
Check whether the Jenkins OWASP Dependency-Check Plugin version is 5.6.4 or earlier and whether users with Item/Configure permission can configure items that process Dependency-Check reports.