Cross-site Scripting in Jenkins Pipeline: Build Step Plugin

MEDIUM 5.4CVE-2023-25762 · GHSA-9j65-3f2q-8q2r · Published 15/02/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:pipeline-build-step Maven	`< 2.18.1`	`2.18.1`
pipeline jenkins	`≤ 2.18`	No fix yet

Description

Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2023-25762 · ADVISORY
jenkinsci/pipeline-build-step-plugin commit 0eaf88a · WEB
jenkinsci/pipeline-build-step-plugin · PACKAGE
jenkins.io/security/advisory/2023-02-15 · WEB
openwall.com/lists/oss-security/2023/02/15/4 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free