GHSA-5x89-75r7-8rjh

GitHub Security Advisory

XSS vulnerability in Jenkins useMango Runner Plugin

✓ GitHub Reviewed MODERATE Has CVE

Multiple form validation endpoints in useMango Runner Plugin 1.4 and earlier do not escape values received from the useMango service.

This results in a cross-site scripting (XSS) vulnerability exploitable by users able to control the values returned from the useMango service.

useMango Runner Plugin 1.5 escapes all values received from the useMango service in form validation messages.

Maven it.infuse.jenkins:usemango-runner

Affected versions: 0 (fixed in 1.5)

CVE-2020-2176

GHSA ID

GHSA-5x89-75r7-8rjh

Published

May 24, 2022 5:13 PM

Last Modified

December 20, 2022 7:24 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

it.infuse.jenkins:usemango-runner

GitHub Reviewed

✓ Yes

Last updated: August 27, 2025 6:31 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.