CVE-2026-53441

Analyzed Analyzed - Analysis Complete

Stored XSS in Jenkins Due to Unescaped Offline Cause Description

Publication date: 2026-06-10

Last updated on: 2026-06-15

Assigner: Jenkins Project

Description

Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the `POST config.xml` API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-10

Last Modified

2026-06-15

Generated

2026-06-30

AI Q&A

2026-06-11

EPSS Evaluated

2026-06-29

NVD

CVE-2026-53441

EUVD

EUVD-2026-36025

Affected Vendors & Products

Vendor	Product	Version / Range
jenkins	jenkins	From 2.483 (inc) to 2.568 (exc)
jenkins	jenkins	From 2.492.1 (inc) to 2.555.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Mitigation Strategies

The vulnerability affects Jenkins versions 2.483 through 2.567 and LTS versions 2.492.1 through 2.555.2. To mitigate this stored cross-site scripting (XSS) vulnerability, you should upgrade Jenkins to a version later than 2.567 or LTS later than 2.555.2 where the issue is fixed.

Executive Summary

This vulnerability exists in Jenkins versions 2.483 through 2.567 and LTS versions 2.492.1 through 2.555.2. It occurs because Jenkins does not properly escape the user-provided description of a generic offline cause that can be set via the POST config.xml API. This flaw results in a stored cross-site scripting (XSS) vulnerability.

Attackers who have Agent/Configure permission can exploit this vulnerability by injecting malicious scripts into the description field, which are then stored and executed in the context of users viewing that data.

Impact Analysis

The impact of this vulnerability is that an attacker with Agent/Configure permission can inject malicious scripts into Jenkins. These scripts can execute in the browsers of users who view the affected descriptions, potentially leading to unauthorized actions, data theft, or session hijacking.

Hi! I’m here to help you understand CVE-2026-53441. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70