-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | <= 2.235.1 | 2.235.2 |
| org.jenkins-ci.main:jenkins-core | maven | >= 2.236, <= 2.244 | 2.245 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper escaping of the upstream job's display name in the build cause description. The commit diff shows removal of <j:out> tags in the Jelly template, which previously attempted to escape the entire message. However, the display name parameter (fullDisplayName) was not individually escaped when passed into the message format string. This allowed malicious HTML/JS in the display name to execute when the build cause was rendered. The added test cases explicitly validate() XSS prevention by injecting a <script> payload into the display name, confirming the vulnerable code path.