Description

Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and version metadata) on plugin download index pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-02T16:17:32.330Z",
  "pubdate": "2026-09-02T16:17:32.330Z",
  "executiveSummary": "Jenkins update-center2 versions 3.18.3 and earlier are susceptible to a stored cross-site scripting (XSS) vulnerability. This security flaw originates from the failure to properly sanitize and escape metadata provided by third-party plugins before rendering it on the download index pages.\nThe vulnerability allows an attacker capable of submitting a plugin for hosting to inject malicious JavaScript into the Jenkins infrastructure's user interface. When an administrator or user visits the affected plugin download index page, the browser executes the injected script within the context of the vulnerable application.\nSuccessful exploitation can lead to unauthorized actions performed on behalf of the victim, theft of session cookies, or the redirection of users to malicious external domains. Given the nature of centralized repository management, the impact is significant, potentially compromising the integrity of the plugin ecosystem and the security posture of administrative users interacting with the update center. The attack vector requires the ability to influence plugin metadata, which is then rendered by the application without sufficient output encoding.",
  "technicalDetails": "The root cause of this vulnerability is improper output encoding within the Jenkins update-center2 component, specifically affecting the generation of HTML content for plugin download index pages. The application fails to sanitize plugin-provided metadata, including plugin names, descriptions, and version strings, before incorporating them into the Document Object Model (DOM).\nAn attacker can exploit this vulnerability by submitting a malicious plugin package to the repository hosting infrastructure. Within the plugin metadata files (such as the manifest or project description fields), the attacker embeds a crafted XSS payload. Because the update-center2 software does not implement rigorous server-side output validation or client-side escaping (e.g., converting special characters like '<', '>', '&', and '\"' into their HTML entities), the payload is stored in the underlying data structure in a raw, executable format.\nThe attack flow follows these steps: First, the attacker defines a malicious payload within the metadata of a plugin candidate. Second, upon the processing of this plugin by the update-center2, the malicious string is indexed and stored in the application's backend database or serialized metadata file. Third, when a user accesses the specific plugin download index page through a web browser, the application fetches the tainted metadata and renders it directly into the HTML response.\nThe browser, encountering the script tags or event handlers (such as 'onerror' or 'onload') embedded by the attacker, interprets the injected data as legitimate executable code. Because the script executes within the security origin of the update-center2 application, it gains full access to the browser's Document Object Model, potentially allowing the attacker to steal administrative session tokens, manipulate the content of the index page to conduct social engineering attacks, or execute background requests. This vulnerability effectively turns the plugin index page into a staging ground for client-side attacks against visitors of the update-center, potentially compromising any authenticated user browsing the repository."
}