-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from unescaped rendering of build display names in the Jenkins UI. The commit diff shows the vulnerable version used raw EL expression ${it.shortDescription} instead of the Jelly <j:out> tag which auto-escapes HTML. The test case in WorkflowRunTest.java demonstrates this by setting a <script> payload as the display name and verifying no alerts are triggered after patching. The direct output of user-controlled data (build name) without escaping in summary.jelly is the root cause.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins.workflow:workflow-job | maven | < 1295.v395eb | 1295.v395eb |
Ongoing coverage of React2Shell