Cross-site Scripting in Jenkins Pipeline: Build Step Plugin

Also known as GHSA-9j65-3f2q-8q2r

Published 3 y ago 2023-02-15 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.4

v3.1 · CNA

CISA KEV

not known exploited

EPSS

82.1%

percentile 100%

Public exploits

none known

Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 19 mo ago 2025-03-19

Exploit prediction (EPSS)

82.13% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	5.4	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`
NVD	3.1	5.4	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`
CNA	3.1	5.4	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`
GitHub	3.1	5.4	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.jenkins-ci.plugins:pipeline-build-step`	<2.18.1	2.18.1

Affected products

Jenkins Project Jenkins Pipeline: Build Step Plugin

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

jenkins.io /security/advisory/2023-02-15/#SECURITY-3019 · x_transferred
openwall.com /lists/oss-security/2023/02/15/4 · mailing-list, x_transferred
nvd.nist.gov /vuln/detail/CVE-2023-25762 · advisory
github.com /jenkinsci/pipeline-build-step-plugin/commit/0eaf88a695244ddb69d16c11b96659167dbead92 · web
github.com /jenkinsci/pipeline-build-step-plugin · package

Sources

CVE List: CVE-2023-25762
GitHub Advisory: GHSA-9j65-3f2q-8q2r
NVD: CVE-2023-25762

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary