The vulnerability resides in the Jenkins Customizable Header Plugin prior to version 295.v2544b_ca_19b_97. An attacker who can alter the plugin’s appearance configuration via Stapler data binding can embed a malicious SVG that includes inline JavaScript. When the plugin renders the SVG, the embedded script executes in the context of any user who views the page, allowing persistent cross‑site scripting. This attack can compromise confidentiality, integrity, and availability of user sessions and can be used to exfiltrate cookies, session tokens, or to perform actions on behalf of the user.

Affected systems The flaw affects Jenkins installations that have the Customizable Header Plugin at version 295.v2544b_ca_19b_97 or earlier. The plugin is part of the Jenkins Project and may be deployed in on‑premise or managed Jenkins environments. Any instance that allows users to configure the plugin’s appearance settings is vulnerable.

Risk and exploitability The CVSS score of 8.8 indicates a high severity, and while an EPSS score is not available, the lack of KEV listing does not diminish the risk of stealthy, long‑term exploitation. The most likely attack vector is through the web‑based configuration interface, where a legitimate user (or someone who can masquerade as one) supplies the malicious SVG. In environments with permissive configuration permissions, the vulnerability can be exploited without additional privilege escalation. The stored XSS payload persists until the configuration is removed or the plugin is updated.