Skip to content
CVE PROGRAM SOURCE RECORD6.8 Medium

CVE-2026-92140

Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting (XS

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
jenkins

Description

Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Jenkins Project Jenkins Gitee Plugin

Default version status: unaffected

  • 0 to ≤ 1301.v8957053c7902affected

References