GHSA-xqpp-26pp-2365
GitHub Security Advisory
XSS vulnerability in Jenkins Markdown Formatter Plugin
✓ GitHub Reviewed
MODERATE
Has CVE
Advisory Details
Jenkins Markdown Formatter Plugin 0.1.0 and earlier uses a Markdown library to parse Markdown that does not escape crafted link target URLs.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter.
Jenkins Markdown Formatter Plugin 0.2.0 uses a different Markdown library that is not affected by this problem.
Affected Packages
Maven
io.jenkins.plugins:markdown-formatter
Affected versions:
0
(fixed in 0.2.0)
Related CVEs
Key Information
5.0
/10
Dataset
Last updated: August 27, 2025 6:31 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.