Stored XSS in Jenkins buildgraph-view Plugin

Publication date: 2026-05-27

Last updated on: 2026-05-28

Assigner: Jenkins Project

Description

Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs or views.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-05-28

Generated

2026-07-07

AI Q&A

2026-05-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-48927

EUVD

EUVD-2026-32518

Affected Vendors & Products

Vendor	Product	Version / Range
jenkins	buildgraph-view	to 1.8 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

The Jenkins buildgraph-view Plugin version 1.8 and earlier contains a stored cross-site scripting (XSS) vulnerability. This occurs because the plugin does not properly escape the build URL, allowing attackers who have the ability to configure jobs or views to inject malicious scripts.

Impact Analysis

This vulnerability can allow attackers with configuration access to inject malicious scripts into the Jenkins interface. These scripts could execute in the context of other users' browsers, potentially leading to unauthorized actions, data theft, or session hijacking.

Hi! I’m here to help you understand CVE-2026-48927. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70