Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents (typically shown after form submissions via Apply button).

This results in a cross-site scripting (XSS) vulnerability exploitable by attackers able to influence notification bar contents.

Jenkins 2.275, LTS 2.263.2 escapes the content shown in notification bars.

Affected Packages

Maven org.jenkins-ci.main:jenkins-core

Affected versions: 0 (fixed in 2.275)

Maven org.jenkins-ci.main:jenkins-core

Affected versions: 2.263.2 (fixed in 2.275)

Related CVEs

CVE-2021-21603

Key Information

GHSA ID

GHSA-98gq-6hxg-52r6

Published

May 24, 2022 5:39 PM

Last Modified

October 27, 2023 1:05 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.main:jenkins-core

GitHub Reviewed

✓ Yes

Dataset

Last updated: August 24, 2025 6:28 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.