-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from two issues in StatusImage.java: 1) The original code used StringEscapeUtils.escapeHtml(link) once, but when concatenated into the SVG onclick attribute's quoted string, this allowed breaking out of the attribute context. 2) No protocol validation allowed dangerous schemes like javascript:. The patch added protocol validation (limiting to http/https) and double-escaping to prevent attribute context escape. The vulnerable code directly constructs the SVG markup with user-controlled 'link' values in an unsafe manner.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:embeddable-build-status | maven | < 2.0.4 | 2.0.4 |
Ongoing coverage of React2Shell