GitHub Advisoryadvisory · Maven

GHSA-43ph-42gv-7965 Jenkins buildgraph-view Plugin does not escape the build URL

MEDIUM Published 2026-05-27 Modified 2026-07-01 Official page ↗
Aliases
CVE-2026-48927
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:buildgraph-view
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Weaknesses
CWE-79
Reviewed
2026-07-01

Affected packages

• Maven org.jenkins-ci.plugins:buildgraph-view: <= 1.8 (no fix yet)

Description

Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs or views. As of publication of this advisory, there is no fix.

Related

Alias · CVE (1)

  • CVE-2026-48927 Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL, resulting in a stored cross-site scripting (XSS)… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References