{"id":"CVE-2026-92135","published":"2026-09-16T14:17:15.493","lastModified":"2026-09-18T13:46:13.937","description":"Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting (XSS) vulnerability.","cvssScore":8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-4118","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows attackers to inject malicious JavaScript through the Jenkins Coverage Plugin's REST API, leading to a stored cross-site scripting (XSS) vulnerability.","exploitability":"Exploitation requires an attacker with Item/Configure permission and knowledge of the specific job configuration. The vulnerability is relatively easy to exploit given the necessary permissions.","blast_radius":"If exploited, the vulnerability could lead to the execution of arbitrary JavaScript in the context of the victim's browser, potentially compromising user data and session integrity.","remediation":"Upgrade to Jenkins Coverage Plugin 3.3358.v9487dde48783 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","api","web","jenkins"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-06T08:46:01.591Z"}}