GHSA-93qh-vwrm-c5pwHighCVSS 8.0

Jenkins: Stored XSS vulnerability in node offline cause description

Published
June 10, 2026
Last Modified
June 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-53441 →

📋 Description

Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the POST config.xml API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.

🎯 Affected products1

  • maven/org.jenkins-ci.main:jenkins-core:>= 2.483, <= 2.567

🔗 References (4)