Jenkins Coverage Plugin has a stored cross-site scripting (XSS) vulnerability

MEDIUM 5.4CVE-2025-67641 · GHSA-v3f3-rf6r-43x5 · Published 10/12/2025 · updated 14/10/2026

In short

CVE-2025-67641 is a MEDIUM (CVSS 5.4) vulnerability affecting io.jenkins.plugins:coverage, coverage (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.31%, higher than 23.6% of all vulnerabilities.
Fix: update to 2.3056 or later.

Package	Affected versions	Patched versions
io.jenkins.plugins:coverage Maven	`< 2.3056`	`2.3056`
coverage jenkins	`≤ 2.3054.ve1ff7b_a_a_123b`	No fix yet

Description

Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.

NVD description

Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2025-67641 · ADVISORY
jenkinsci/coverage-plugin commit 1dfe888 · WEB
jenkinsci/coverage-plugin · PACKAGE
jenkins.io/security/advisory/2025-12-10 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

io.jenkins.plugins:coverage

Maven

< 2.3056

2.3056

coverage

jenkins

≤ 2.3054.ve1ff7b_a_a_123b

No fix yet

Description

NVD description

Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.