-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from the unescaped 'tooltip' attribute in the Jelly template responsible for rendering help icons. The commit diff shows the addition of h.xmlEscape() to sanitize this attribute. Since Jelly templates generate HTML/XML content, the lack of escaping in the original code allowed raw user/plugin-provided tooltip content to be interpreted as HTML/XML, enabling XSS. The test cases added in the commit explicitly validate() XSS prevention by checking that injected HTML payloads are escaped, confirming this as the attack vector.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | <= 2.235.3 | 2.235.4 |
| org.jenkins-ci.main:jenkins-core | maven | >= 2.236, <= 2.251 | 2.252 |
Ongoing coverage of React2Shell