-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unescaped job descriptions in tooltips. Jenkins plugins typically use Jelly templates for UI rendering. The advisory explicitly states the XSS occurs in tooltips via job descriptions, which would be rendered in a Jelly view component. The most likely location is the IconColumn's Jelly template that displays job icons with descriptions. The absence of HTML escaping (via ${job.description?html} or similar) in tooltip attributes creates the vulnerability. This matches Jenkins XSS patterns and the described attack vector.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:custom-job-icon | maven | <= 0.2 |
Ongoing coverage of React2Shell