Stored XSS vulnerability in Jenkins button labels

MEDIUM 5.4CVE-2021-21608 · BIT-jenkins-2021-21608 · GHSA-wv63-gwr9-5c55 · Published 13/01/2021 · updated 17/06/2026

In short

CVE-2021-21608 is a MEDIUM (CVSS 5.4) vulnerability affecting org.jenkins-ci.main:jenkins-core, jenkins (jenkins).
Chance of exploitation in the next 30 days (EPSS): 1.0%, higher than 64.0% of all vulnerabilities.
Fix: update to 2.275 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.main:jenkins-core Maven	`≥ 2.263.2, < 2.275< 2.275`	`2.275`
jenkins jenkins	`≤ 2.263.1≤ 2.274`	No fix yet

Description

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI.

This results in a cross-site scripting vulnerability exploitable by attackers with the ability to control button labels. An example of buttons with a user-controlled label are the buttons of the Pipeline input step.

Jenkins 2.275, LTS 2.263.2 escapes button labels in the Jenkins UI.

NVD description

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to control button labels.