What is GHSA-v3f3-rf6r-43x5?

GHSA-v3f3-rf6r-43x5 is a security advisory published by GitHub Security Advisories with High severity. Jenkins Coverage Plugin has a stored cross-site scripting (XSS) vulnerability

Which CVE IDs does GHSA-v3f3-rf6r-43x5 cover?

GHSA-v3f3-rf6r-43x5 covers the following CVE IDs: CVE-2025-67641. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v3f3-rf6r-43x5?

GHSA-v3f3-rf6r-43x5 has a CVSS v3 base score of 8.0, published by GitHub Security Advisories.

Which products are affected by GHSA-v3f3-rf6r-43x5?

GHSA-v3f3-rf6r-43x5 affects 1 product, including: maven/io.jenkins.plugins:coverage:\u003c 2.3056.

GHSA-v3f3-rf6r-43x5HighCVSS 8.0

Jenkins Coverage Plugin has a stored cross-site scripting (XSS) vulnerability

Vendor

GitHub Security Advisories

Published

December 10, 2025

Last Modified

December 10, 2025

🔗 CVE IDs covered (1)

CVE-2025-67641 →

📋 Description

Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.

🎯 Affected products1

maven/io.jenkins.plugins:coverage:< 2.3056

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-67641
https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3611
https://github.com/jenkinsci/coverage-plugin/commit/1dfe888b02499d39185397862cf2790efc03e955
https://github.com/advisories/GHSA-v3f3-rf6r-43x5