Description

Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allowing attackers to configure a custom SVG icon containing inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-02T16:17:31.940Z",
  "pubdate": "2026-09-02T16:17:31.940Z",
  "executiveSummary": "The Jenkins Customizable Header plugin, in versions 295.v2544b_ca_19b_97 and earlier, is susceptible to a stored Cross-Site Scripting (XSS) vulnerability.\nThis vulnerability stems from insecure Stapler data binding that allows an attacker to manipulate the plugin's appearance configuration.\nSpecifically, the flaw permits the injection of arbitrary, malicious SVG content containing inline JavaScript into the application interface.\nSuccessful exploitation results in Stored XSS, allowing an attacker to execute malicious scripts within the context of the victim's session.\nThe impact includes potential session hijacking, unauthorized actions performed on behalf of the user, and the exfiltration of sensitive information, such as CSRF tokens or authentication data.\nThis vulnerability poses a significant risk to the integrity and confidentiality of the Jenkins environment, particularly if an attacker can coerce an administrator into interacting with the malicious payload.",
  "technicalDetails": "The vulnerability resides in the configuration handling mechanism of the Jenkins Customizable Header plugin, which fails to properly sanitize or validate user-supplied input when binding data via Stapler.\nStapler is the request-handling framework used by Jenkins; the affected component utilizes this framework to map HTTP request parameters directly to object properties without sufficient security constraints.\nThe root cause is an improper neutralization of input during the configuration update process, specifically regarding the handling of SVG files used for appearance customization.\nThe attack flow begins when an attacker, typically having sufficient permissions to modify plugin configurations, submits a crafted HTTP request to the vulnerable endpoint responsible for saving the Customizable Header settings.\nWithin this request, the attacker specifies a malicious SVG file in the configuration field. The SVG structure includes a <script> tag or event handlers (e.g., onload) containing arbitrary JavaScript.\nBecause the application fails to sanitize this input or restrict the schema of the uploaded SVG, the malicious payload is persisted directly into the Jenkins configuration storage.\nWhen a legitimate user, such as an administrator or any other authenticated user viewing the customized header, accesses the affected Jenkins page, the browser renders the malicious SVG.\nThe browser executes the embedded JavaScript within the context of the user's session, bypassing the Same-Origin Policy (SOP).\nPost-exploitation, the malicious script can perform various actions, such as capturing sensitive session cookies, making unauthorized API calls to the Jenkins instance, or redirecting the user to malicious sites.\nThe scope of the attack depends on the privilege level of the victim user who views the rendered SVG.\nVersions 295.v2544b_ca_19b_97 and earlier are confirmed as affected."
}