CVE-2026-84677 in update-center2 Plugin
Summary
by MITRE • 09/02/2026
Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and version metadata) on plugin download index pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The Jenkins update-center2 component, specifically versions 3.18.3 and earlier, contains a critical input validation flaw that allows for the storage of malicious script content within metadata fields provided by third-party plugins. This vulnerability arises because the application fails to properly sanitize or escape user-controlled data before rendering it on plugin download index pages. When an attacker manages to publish a malicious plugin to a repository accessible by Jenkins instances, they can embed JavaScript code directly into standard metadata attributes such as the plugin name, description, or version string. Because these fields are rendered in HTML without adequate encoding, the browser interprets the embedded scripts as executable content rather than static text data.
This architectural oversight results in a stored cross-site scripting vulnerability that persists on the server side until the malicious entry is removed from the index. Unlike reflected XSS attacks which require tricking users into clicking a specific link, this flaw ensures that any administrator or user who views the plugin download page will have their session compromised automatically upon loading the page. The attacker does not need to manipulate URLs or exploit query parameters; instead, they rely on the inherent trust Jenkins places in its update center metadata structure. This persistence mechanism significantly lowers the barrier for exploitation and increases the likelihood of successful compromise across multiple user sessions.
The operational impact of this vulnerability is severe, as it grants attackers the ability to execute arbitrary JavaScript within the context of the victim's browser session. Through this execution environment, an attacker can perform a variety of malicious actions including stealing sensitive authentication tokens such as Jenkins API keys or CSRF tokens, hijacking active administrative sessions, and performing unauthorized actions on behalf of the user. In many enterprise environments where Jenkins is integrated with other CI/CD pipelines and source control systems, compromising these credentials can lead to broader system compromise, supply chain attacks, and exfiltration of proprietary codebases. The attacker could also redirect users to phishing sites or deface the interface to disrupt development workflows.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. It is particularly dangerous because it involves stored data rather than transient input. In terms of adversary tactics, this exploit maps directly to the ATT&CK technique T1059 Command and Scripting Interpreter via JavaScript execution within a browser context. Furthermore, since Jenkins plugins are often trusted components that run with elevated privileges on the host system, successful exploitation can serve as an initial access vector for deeper infrastructure penetration if combined with other vulnerabilities or misconfigurations in the CI/CD pipeline.
Mitigation strategies must focus on immediate remediation and long-term defensive coding practices. The primary solution is to upgrade Jenkins update-center2 to version 3.18.4 or later, where this input validation flaw has been addressed by implementing strict output encoding for all plugin metadata fields before they are rendered in HTML contexts. Organizations should also audit their existing plugins against known malicious repositories and remove any suspicious entries from local caches if possible. To prevent future occurrences, developers must adhere to the principle of least privilege when rendering dynamic content and consistently apply context-aware escaping techniques regardless of whether data originates from internal sources or external plugin providers. Regular security reviews of third-party integrations are essential to maintain the integrity of automated build environments.