Description
Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control build log contents.
Remediation
References
Related Vulnerabilities
Apache Tomcat Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-5885)
WordPress 4.2.x Cross-Site Request Forgery (4.2 - 4.2.22)
WordPress Plugin WP Mail Log Cross-Site Scripting (1.1.1)
Werkzeug WSGI Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2024-34069)
e107 Deserialization of Untrusted Data Vulnerability (CVE-2025-61505)