-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:junit | maven | <= 1166.va | 1166.1168.vd6b_8042a_06de |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper escaping in the Jelly template's JavaScript context. The commit diff shows the fix added htmlAttributeEscape + jsStringEscape layering, indicating the original code only used jsStringEscape(url) when constructing the 'open' and 'close' JavaScript handlers. This allowed XSS via class names containing JS-breaking characters. The test case in CaseResultTest.java explicitly verifies alert prevention, confirming the attack vector involved JS execution during test expansion.
Ongoing coverage of React2Shell