CVE-2026-70441 in Summary Display Plugin
Summary
by MITRE • 08/05/2026
Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Create or Item/Configure permission.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/05/2026
The Jenkins Summary Display Plugin vulnerability represents a critical stored cross-site scripting weakness that exists in versions 1.15 and earlier of the plugin. This flaw manifests when the plugin fails to properly escape job names within JavaScript contexts on build report pages, creating an avenue for malicious code injection. The vulnerability specifically targets the web interface rendering process where user-provided job names are directly embedded into client-side javascript without adequate sanitization or encoding. Attackers with minimal permissions including Item/Create or Item/Configure access can exploit this weakness by crafting malicious job names that contain crafted javascript payloads, which then execute in the context of other users who view the affected build reports.
The technical mechanism behind this vulnerability aligns with CWE-79, which describes cross-site scripting flaws occurring when untrusted data is improperly incorporated into web pages without proper escaping or encoding. This particular implementation flaw demonstrates how insufficient input validation and output encoding can create persistent XSS vulnerabilities even in seemingly benign plugin components. The vulnerability operates as a stored XSS attack because the malicious payload is saved within the Jenkins system and executed whenever affected pages are rendered, rather than requiring immediate user interaction with crafted links or forms. The JavaScript context where the job name is embedded provides the perfect environment for code execution since the browser interprets the unescaped data as executable javascript rather than plain text.
The operational impact of this vulnerability extends beyond simple data theft or defacement, as it enables attackers to potentially escalate privileges within the Jenkins environment. When users with Item/Create or Item/Configure permissions create jobs with malicious names containing javascript payloads, these payloads execute in the browser context of other users who view the build reports. This creates a persistent threat where attackers can establish backdoors, steal session cookies, redirect users to malicious sites, or perform actions on behalf of authenticated users. The vulnerability particularly affects organizations relying on Jenkins for continuous integration and deployment workflows where multiple users access build reports and job configurations, amplifying the potential attack surface.
Mitigation strategies for this vulnerability require immediate patching of the Jenkins Summary Display Plugin to version 1.16 or later where proper output escaping has been implemented. Organizations should also implement additional defensive measures including input validation for job names, regular security scanning of plugin components, and monitoring for anomalous job creation patterns that might indicate exploitation attempts. The remediation process should include comprehensive testing of the patched plugin to ensure all javascript contexts properly escape user-provided data. Security teams should also consider implementing content security policies and browser-based protections as additional layers of defense, though these measures are supplemental to the core patching requirement. Regular vulnerability assessments of Jenkins plugins and the broader Jenkins ecosystem remain essential for maintaining security posture against similar vulnerabilities in other components.
This vulnerability exemplifies how seemingly minor output encoding failures can create significant security risks in web applications, particularly within enterprise automation platforms like Jenkins where privileged access combinations exist. The attack vector demonstrates how low-privilege users with specific permissions can leverage plugin weaknesses to create persistent threats, highlighting the importance of comprehensive security testing across all components of automated build and deployment systems. The remediation process should also include education for administrators about the security implications of plugin permissions and the necessity of keeping all Jenkins components updated to mitigate known vulnerabilities.