Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit resources processed by the plugin.

Affected Packages

Maven org.jenkins-ci.plugins:junit

Affected versions: 0 (fixed in 1166.1168.vd6b_8042a_06de)

Related CVEs

CVE-2023-25761

Key Information

GHSA ID

GHSA-ph74-8rgx-64c5

Published

February 15, 2023 3:30 PM

Last Modified

February 23, 2023 9:31 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.plugins:junit

GitHub Reviewed

✓ Yes

Dataset

Last updated: July 3, 2025 6:26 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.