8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-5806

CVE-2025-5806: Jenkins Gatling Plugin Vulnerable to Cross-Site Scripting (XSS)

Jenkins Gatling Plugin 136.vb_9009b_3d33a_e serves Gatling reports in a manner that bypasses the Content-Security-Policy protection introduced in Jenkins 1.641 and 1.625, resulting in a cross-site scripting (XSS) vulnerability exploitable by users able to change report content.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-5806

CVE-2025-5806:

8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.jenkins-ci.plugins:gatling	maven	= 136.vb

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (CVE-2025-5806 / GHSA-gw97-cqwg-xmh4) in the Jenkins Gatling Plugin allows Cross-Site Scripting (XSS) because it serves Gatling reports without adequate Content Security Policy (CSP) and HTML sanitization. The exploitability relies on a user being able to modify the content of the Gatling reports.

The analysis of the provided patch (commit b1f0853164c2bc708725f15b897f74e1991af95a) reveals that the io.gatling.jenkins.ReportViewer class is central to serving these reports. Specifically, two methods were identified as vulnerable:

io.gatling.jenkins.ReportViewer.doIndex(StaplerRequest req, StaplerResponse rsp): This method handles requests for the main index.html file of a report. Before the patch, it read the file and wrote its content directly to the HTTP response stream without sanitizing potentially malicious HTML/JavaScript or setting appropriate CSP headers. This allowed injected scripts in index.html to execute in the user's browser.
io.gatling.jenkins.ReportViewer.doDynamic(StaplerRequest req, StaplerResponse rsp): This method handles requests for other files within the report directory (e.g., other HTML files, CSS, JavaScript assets). Similar to doIndex, if the requested file was an HTML file, its content was streamed directly to the browser without sanitization or proper CSP in the vulnerable version. This created another vector for XSS if an attacker could place malicious HTML files in the report.

The patch addresses these issues by:

Reading the HTML content into a string.
Applying sanitization to remove script tags, event handlers, and javascript: URLs.
Setting restrictive Content-Security-Policy, X-Content-Type-Options, and X-Frame-Options headers.

These changes prevent the execution of arbitrary scripts embedded in the Gatling reports, thus mitigating the XSS vulnerability. The functions doIndex and doDynamic are the direct points where malicious report content would have been processed and served to the user's browser in an unsafe manner.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.