Jenkins 2.579 and earlier, including LTS 2.568.2 and earlier, contain a stored XSS vulnerability in the system log viewer. The log viewer fails to escape log record metadata—including source, level, and timestamp—allowing a malicious actor to inject arbitrary JavaScript that is persisted with future log presentations. This flaw is a classic example of Improper Input Validation, documented as CWE‑79, and can lead to execution of attacker‑supplied code in the context of the Jenkins web interface, potentially abusing user sessions or executing unauthorized actions on the host.

The affected systems are Jenkins installations running version 2.579 or earlier, and the LTS branch versions up to 2.568.2. The vulnerability resides in the core log viewer component of the Jenkins web UI, affecting all users who view the system log.

The CVSS score of 8.8 marks this flaw as high severity. Exploitability is limited to attackers who can control an agent process, giving them the ability to write malicious log entries. Although EPSS data is unavailable and the vulnerability is not listed in CISA KEV, the risk remains significant because agent controls are common in Jenkins deployments. The attack vector is local or remote, depending on who controls the agent, and the impact is fully contained within the Jenkins web interface.