CVE-2026-92135 in Coverage Plugin
Summary
by MITRE • 09/16/2026
Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting (XSS) vulnerability.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Jenkins Coverage Plugin version 3.358.v9487dde48783 and earlier contains a critical security flaw related to insufficient input validation when processing job configurations via the REST API. This vulnerability specifically affects how the plugin handles coverage result identifiers, which are intended to link test results with specific build artifacts or reports. Under normal operational conditions, these identifiers should be sanitized to ensure they represent safe, expected data types such as file paths or numeric IDs. However, due to a lack of rigorous validation logic within the REST API endpoint responsible for updating job configurations, an attacker can inject malicious payloads directly into this field without triggering any error states or rejection mechanisms from the server-side processing engine.
The core technical flaw lies in the acceptance and subsequent storage of arbitrary string values as coverage result identifiers. When a user with Item/Configure permissions submits a configuration change through the REST API, the plugin fails to validate whether the provided identifier conforms to expected safe patterns. This oversight allows for the injection of JavaScript code by utilizing the javascript: URI scheme as the value for the coverage results ID. Because Jenkins typically renders these stored identifiers in various parts of its web interface, including job detail pages and configuration views, any malicious script embedded within this field will be executed automatically when an authorized user or administrator accesses the affected page. This mechanism effectively bypasses standard content security policies that might otherwise mitigate client-side code execution if the payload were not stored persistently in a trusted context.
This vulnerability constitutes a Stored Cross-Site Scripting (XSS) attack, categorized under CWE-79: Improper Neutralization of Input During Web Page Generation. The severity is amplified by the requirement for Item/Configure permission rather than full administrative access, meaning that compromise can occur through lower-level privileged accounts often used for CI/CD pipeline management. Once executed, the malicious JavaScript runs in the context of the victim's session with Jenkins' authentication cookies and security tokens intact. This allows an attacker to perform actions on behalf of the user, such as modifying other job configurations, stealing sensitive environment variables or credentials stored within Jenkins jobs, exfiltrating source code artifacts, or pivoting further into the internal network if Jenkins is integrated with downstream deployment systems. The persistence of this payload means that every subsequent view of the compromised job configuration triggers the attack vector without requiring additional interaction from the attacker after the initial injection.
From a threat modeling perspective aligned with MITRE ATT&CK frameworks, this vulnerability facilitates Initial Access and Credential Access techniques. Specifically, it maps to T1059: Command and Scripting Interpreter through the use of JavaScript execution within a web application context. The stored nature of the XSS aligns with persistence mechanisms where malicious code remains active until manually removed or the job is deleted. Furthermore, because Jenkins often holds high-value secrets such as API tokens for cloud providers or repository access keys, successful exploitation can lead to significant data exfiltration and lateral movement within an organization's infrastructure. The impact extends beyond simple defacement; it represents a direct pathway to compromising the integrity of the entire continuous integration pipeline managed by that instance.
Mitigation strategies must prioritize immediate remediation through software updates. Administrators should upgrade the Jenkins Coverage Plugin to version 3.359.v0a_6e18d7c2f or later, where this input validation flaw has been addressed with stricter type checking and sanitization of coverage result identifiers before storage. In environments where upgrading is not immediately feasible, a temporary workaround involves restricting REST API access for Item/Configure permissions to only those users who are strictly trusted and monitored. Additionally, implementing strict Content Security Policy headers within the Jenkins instance can help mitigate the impact by preventing inline script execution, although this may interfere with legitimate plugin functionality if not carefully configured. Regular auditing of job configurations via the API is also recommended to detect any unauthorized modifications that might indicate an active exploitation attempt in progress.