CVE-2026-92140: XSS
Published Sep 16, 2026
·Updated
Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint.
Affected Software
1 affected component
jenkinsci/gitee-plugin<=1301.v8957053c7902
Event History
Sep 16, 2026
CVE Published
via MITRE·01:53 PM
Data Sourced
via MITRE·01:53 PM
Description
Frequently Asked Questions
1
Who can exploit this issue?
An attacker must be able to trigger builds through the Jenkins Gitee Plugin webhook endpoint and supply a crafted sender name in a Gitee push webhook payload.
2
Where is the malicious content stored or displayed?
The unescaped sender name is stored in Jenkins build causes. The issue is a stored XSS vulnerability, so impact occurs when the affected stored value is rendered in Jenkins.
3
Are older plugin versions affected?
Jenkins Gitee Plugin version 1301.v8957053c7902 and earlier is affected.