What is GHSA-xjjc-6r4m-w362?

GHSA-xjjc-6r4m-w362 is a security advisory published by GitHub Security Advisories with Medium severity. Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections...

Which CVE IDs does GHSA-xjjc-6r4m-w362 cover?

GHSA-xjjc-6r4m-w362 covers the following CVE IDs: CVE-2026-117613. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xjjc-6r4m-w362?

GHSA-xjjc-6r4m-w362 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

GHSA-xjjc-6r4m-w362MediumCVSS 5.4

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections...

Vendor

GitHub Security Advisories

Published

October 28, 2026

Last Modified

November 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-117613 →

📋 Description

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted config.xml files that can lead to, e.g., stored cross-site scripting (XSS) vulnerabilities.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-117613
https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4225
https://github.com/advisories/GHSA-xjjc-6r4m-w362