-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unsanitized HTML output in badge content rendering. The pre-patch versions of BadgeSummaryAction.getText() and HtmlBadgeAction.getHtml() directly returned user-controlled input. The security fix introduced HTML sanitization via RawHtmlMarkupFormatter in both methods, and test cases explicitly validate() script tag removal. The functions' pre-patch behavior matches the XSS vulnerability description, and the commit diff directly modifies these methods to add sanitization.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:badge | maven | <= 1.4 | 1.5 |
A Semantic Attack on Google Gemini - Read the Latest Research