DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted commit notifications to the `/githook/` endpoint (see also [SECURITY-2867](https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2867)).

This vulnerability is only exploitable in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier. See the [LTS upgrade guide](https://www.jenkins.io/doc/upgrade-guide/2.303/#SECURITY-2452).

Affected Packages

Maven com.groupon.jenkins-ci.plugins:DotCi

Affected versions: 0 (last affected: 2.40.00)

Related CVEs

CVE-2022-41239

Key Information

GHSA ID

GHSA-q9g4-9fx4-v533

Published

September 22, 2022 12:00 AM

Last Modified

December 6, 2022 10:40 PM

CVSS Score

7.5 /10

Primary Ecosystem

Maven

Primary Package

com.groupon.jenkins-ci.plugins:DotCi

GitHub Reviewed

✓ Yes

Dataset

Last updated: August 24, 2025 6:28 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.