Jenkins Badge Plugin cross-site scripting vulnerability

MEDIUM 5.4CVE-2018-1000604 · GHSA-3xjq-8j89-xrw9 · Published 26/06/2018 · updated 17/06/2026

In short

CVE-2018-1000604 is a MEDIUM (CVSS 5.4) vulnerability affecting org.jenkins-ci.plugins:badge, badge (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.70%, higher than 53.4% of all vulnerabilities.
Fix: update to 1.5 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:badge Maven	`< 1.5`	`1.5`
badge jenkins	`≤ 1.4`	No fix yet

Description

A persisted cross-site scripting vulnerability exists in Jenkins Badge Plugin 1.4 and earlier in BadgeSummaryAction.java, HtmlBadgeAction.java that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser when that other user performs some UI actions. Badge Plugin 1.5 and newer sanitizes the provided HTML for display on the Jenkins web UI.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2018-1000604 · ADVISORY
jenkinsci/badge-plugin commit 63a7744 · WEB
jenkinsci/badge-plugin · PACKAGE
jenkins.io/security/advisory/2018-06-25 · WEB

More vulnerabilities in org.jenkins-ci.plugins:badge

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:badge

Maven

< 1.5

1.5

badge

jenkins

≤ 1.4

No fix yet

Description

NVD description