CVE-2022-27212: Stored Cross-site Scripting vulnerability in Jenkins List Git Branches Parameter Plugin

The vulnerability stems from two key factors: 1) The plugin fails to escape the parameter name during rendering, and 2) It explicitly disables Jenkins' security mechanism (introduced in 2.44/LTS 2.32.2) that would normally prevent XSS via unescaped parameters. The isAutoEscaped() method's override to return false is explicitly mentioned in the advisory as the mechanism bypass. While the exact view template rendering the parameter name would also be involved, the root cause is the disabled escaping mechanism controlled by this method. The confidence is high because the advisory specifically calls out this security mechanism bypass.