Description

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the `javascript:` scheme, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-09-02T16:17:31.147Z",
  "pubdate": "2026-09-02T16:17:31.147Z",
  "executiveSummary": "The Jenkins SonarQube Scanner Plugin is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. The flaw exists due to inadequate input validation and output encoding of dashboard link URLs generated from scanner results. By failing to restrict URL schemes to safe protocols, the plugin allows the injection of malicious 'javascript:' URI schemes.\nThis vulnerability affects Jenkins SonarQube Scanner Plugin version 2.18.3 and all earlier versions. Successful exploitation requires an attacker to possess 'Item/Configure' permissions, which are typically granted to developers or users with configuration access to Jenkins jobs. Upon successful injection, an attacker can execute arbitrary JavaScript in the context of an authenticated victim's session.\nThe impact includes the potential for session hijacking, unauthorized actions performed on behalf of the victim, and unauthorized data exfiltration within the Jenkins environment. Given the high-privilege nature of Jenkins administrative or job-configuration roles, this represents a significant security risk to the CI/CD pipeline integrity.",
  "technicalDetails": "The root cause of this vulnerability is the improper sanitization of user-controlled input used to construct hyperlinks pointing to SonarQube dashboard results. The Jenkins SonarQube Scanner Plugin facilitates the integration of scan metrics by generating dashboard links within the Jenkins UI. However, the plugin fails to perform allow-list validation on the URI schemes provided during the configuration of the scanner results.\nSpecifically, the application logic does not restrict input to legitimate web protocols such as 'http://' or 'https://'. By neglecting to validate the protocol scheme, the plugin permits the 'javascript:' pseudo-protocol. When a dashboard link is rendered by the Jenkins frontend, the browser interprets the 'javascript:' prefix as an instruction to execute the subsequent code block upon user interaction, such as a click event.\nThe attack flow proceeds as follows: First, an attacker with 'Item/Configure' permission modifies the SonarQube configuration parameters for a specific Jenkins job. Instead of a standard URL, the attacker inserts a payload formatted as 'javascript:alert(document.cookie)' or a more sophisticated script designed to perform actions via the Jenkins REST API. Once the configuration is saved, the Jenkins SonarQube Scanner Plugin stores this malicious string within the project configuration persistent data.\nWhen a victim, such as a build administrator or a privileged user, navigates to the build dashboard or the SonarQube integration view, the plugin renders the stored URL into the document object model (DOM). When the victim clicks the affected link, the browser executes the malicious payload. Because the execution occurs within the context of the victim's session, the attacker gains the ability to perform any action authorized to the victim, including initiating new builds, viewing sensitive credentials, or modifying security configurations.\nSince the vulnerability is stored, it remains resident within the job configuration until manually corrected, providing a persistent vector for targeting any user with sufficient privileges to view the dashboard. The lack of Content Security Policy (CSP) enforcement regarding these dynamically generated links further facilitates the execution of arbitrary scripts, allowing for potential account takeover or lateral movement within the Jenkins master instance."
}