Description

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestamp) resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-02T16:17:29.527Z",
  "pubdate": "2026-09-02T16:17:29.527Z",
  "executiveSummary": "A stored Cross-Site Scripting (XSS) vulnerability exists within the Jenkins system log viewer due to improper output sanitization of log metadata. This vulnerability affects Jenkins versions 2.579 and earlier, and LTS versions 2.568.2 and earlier. The flaw allows an attacker who has compromised or controls an agent process to inject malicious JavaScript into log record metadata fields, specifically the source, level, and timestamp. When a Jenkins administrator views the system logs, the injected script executes within the context of the administrator's browser session. The primary impact of this vulnerability is unauthorized execution of arbitrary code in the victim's browser, which may lead to session hijacking, unauthorized configuration changes, or further administrative actions within the Jenkins environment. Exploitation requires the attacker to have sufficient control over an agent process to influence the log data being reported to the controller. This vulnerability represents a significant risk to Jenkins security posture as it bridges the gap between agent compromise and controller-level administrative access.",
  "technicalDetails": "The vulnerability resides in the Jenkins web interface component responsible for rendering system log entries. The root cause is the failure to perform adequate input sanitization or output encoding on metadata fields associated with log records. Specifically, the fields corresponding to the log source, severity level, and timestamp are rendered in the HTML document without being passed through necessary context-aware escaping routines.\nThe exploitation flow begins when an attacker gains control over a Jenkins agent process. An agent process is typically tasked with reporting system logs and status updates to the primary Jenkins controller. By manipulating these outgoing log messages, the attacker can insert arbitrary string data into the metadata fields. Because the Jenkins controller trustfully records this metadata, the malicious payload is stored persistently within the Jenkins system log database.\nWhen a high-privileged user, such as a Jenkins administrator, accesses the 'System Log' page via the web interface to inspect logs, the controller retrieves the stored log records. Due to the lack of output escaping, the browser interprets the injected JavaScript payload contained within the log metadata as legitimate markup. This triggers the execution of the payload within the session of the authenticated administrator.\nThe impact of this execution is broad; the attacker can perform any action the administrator is authorized to perform via the Jenkins UI. This includes creating new users, modifying build pipelines, injecting malicious plugins, or extracting sensitive environment variables and credentials stored within the Jenkins configuration. The attack is particularly effective because it leverages the trust relationship between the Jenkins controller and its managed agents, turning legitimate logging functionality into an injection vector for cross-site scripting."
}