{"id":"CVE-2026-92134","published":"2026-09-16T14:17:15.397","lastModified":"2026-09-18T13:46:13.937","description":"Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting (XSS) vulnerability.","cvssScore":8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-3937","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows attackers to inject malicious JavaScript through the Jenkins Warnings Plugin, leading to a stored cross-site scripting (XSS) vulnerability.","exploitability":"Exploitation is relatively straightforward for attackers with Item/Configure permission, as they can use a javascript: scheme URL to inject malicious content.","blast_radius":"If exploited, the vulnerability could affect any user who visits a page containing the injected content, potentially leading to data theft or further compromise.","remediation":"Upgrade to Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","web","jenkins","plugin","permissions"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-06T08:46:02.513Z"}}