Description
Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the `javascript:` scheme, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Published: 2026-09-02
Score: 8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the Jenkins SonarQube Scanner Plugin version 2.18.3 and earlier, where it fails to restrict permissible URL schemes for dashboard links embedded in SonarQube scanner results. This omission permits the use of the "javascript:" scheme, which enables attackers holding Item/Configure rights to embed malicious scripts that persist across configuration changes, leading to stored cross‑site scripting.

Affected Systems

Jenkins deployments utilizing the SonarQube Scanner Plugin up to and including version 2.18.3 are susceptible. This includes any instance where the plugin is installed and active, regardless of company size or Jenkins distribution.

Risk and Exploitability

The CVSS score of 8.0 signals a high severity assessment, and while EPSS data is not available, the lack of a KEV listing indicates no publicly documented exploits as of the data cutoff. Attackers need Item/Configure permission to introduce malicious dashboard links; once injected, the script executes in the context of any user who opens the affected configuration, eroding confidentiality and integrity of Jenkins dashboards.

Generated by OpenCVE AI on September 3, 2026 at 11:08 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the SonarQube Scanner Plugin to version 2.18.4 or later to enforce URL scheme restrictions.
  • Restrict Item/Configure permission to trusted administrators to limit potential attackers.
  • If an upgrade cannot be performed immediately, manually remove or sanitize dashboard links containing the "javascript:" scheme before they are persisted in Jenkins configuration.

Generated by OpenCVE AI on September 3, 2026 at 11:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 03 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Jenkins Project
Jenkins Project jenkins Sonarqube Scanner Plugin
Vendors & Products Jenkins Project
Jenkins Project jenkins Sonarqube Scanner Plugin

Thu, 03 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Title Stored XSS via Unrestricted URL Schemes in Jenkins SonarQube Scanner Plugin

Wed, 02 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-79
Metrics cvssV3_1

{'score': 8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 02 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
Description Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the `javascript:` scheme, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
References

Subscriptions

Jenkins Project Jenkins Sonarqube Scanner Plugin
cve-icon MITRE

Status: PUBLISHED

Assigner: jenkins

Published:

Updated: 2026-09-02T17:04:35.852Z

Reserved: 2026-09-01T21:55:27.034Z

Link: CVE-2026-84665

cve-icon Vulnrichment

Updated: 2026-09-02T17:04:28.788Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-02T16:17:31.147

Modified: 2026-09-03T17:13:16.490

Link: CVE-2026-84665

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T16:27:04Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')