High · 8.0 CVE-2026-92135 EUVD-2026-80759GHSA-29m4-vpx5-mmrm

Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted th…

Published Sep 16, 2026 · Updated Sep 16, 2026 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Coverage Plugin Category: Web / CMS

Description

Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting (XSS) vulnerability.

Affected products

Vendor	Product	Affected	Fixed
Jenkins Project	Jenkins Coverage Plugin	—	3.3325.3327.v26c59e218691

Advisories 1

WID-SEC-2026-3428 Jenkins Plugins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 21, 2026

References

Jenkins Security Advisory 2026-09-16 vendor-advisory