What is GHSA-qgwr-f9q8-fxgq?

GHSA-qgwr-f9q8-fxgq is a security advisory published by GitHub Security Advisories with High severity. In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log...

Which CVE IDs does GHSA-qgwr-f9q8-fxgq cover?

GHSA-qgwr-f9q8-fxgq covers the following CVE IDs: CVE-2026-84648. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qgwr-f9q8-fxgq?

GHSA-qgwr-f9q8-fxgq has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-qgwr-f9q8-fxgqHighCVSS 8.8

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log...

Vendor

GitHub Security Advisories

Published

September 2, 2026

Last Modified

September 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-84648 →

📋 Description

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestamp) resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-84648
https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3967
https://github.com/advisories/GHSA-qgwr-f9q8-fxgq