CVE-2026-92136 in OWASP Dependency-Check Plugin
Summary
by MITRE • 09/16/2026
Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Jenkins OWASP Dependency-Check plugin version 5.6.4 and prior versions contain a critical security flaw related to improper input validation and output encoding within the web interface. This vulnerability manifests as a stored cross-site scripting (XSS) issue, which is classified under CWE-79 in the Common Weakness Enumeration standard. The root cause lies in the plugin's failure to properly sanitize or encode specific fields from OWASP Dependency-Check reports before rendering them on the Jenkins user interface. Specifically, values associated with Common Weakness Enumerations (CWE) are not escaped during the HTML generation process. This oversight allows malicious actors who have been granted Item/Configure permissions within a Jenkins project to inject arbitrary JavaScript code into these fields. Because the data is stored in the report and subsequently served to other users without sanitization, it qualifies as a persistent or stored XSS attack vector rather than a reflected one.
The operational impact of this vulnerability extends beyond simple script execution. An attacker with Item/Configure access can craft a malicious Dependency-Check report that includes specially crafted CWE identifiers containing embedded JavaScript payloads. When another user views the project's security dashboard or dependency analysis results, their browser will execute the injected scripts in the context of the Jenkins session. This enables several severe consequences including session hijacking through theft of authentication cookies or tokens, credential harvesting by phishing for login details via fake forms rendered within the page, and potentially full system compromise if combined with other vulnerabilities such as CSRF token bypasses or insecure API endpoints. The attacker can also perform actions on behalf of the victim user, such as modifying project configurations, triggering builds, or accessing sensitive repository data, effectively escalating their privileges from a limited configuration role to that of an active session holder.
From a threat modeling perspective aligned with MITRE ATT&CK frameworks, this vulnerability facilitates techniques associated with Collection via Browser Redirect and potentially Account Manipulation if the attacker uses the hijacked session to create new accounts or modify existing ones for persistence. The lack of output encoding represents a fundamental failure in secure coding practices where trusted data is treated as executable code without proper validation. This type of flaw is particularly dangerous because it leverages legitimate administrative capabilities, making detection difficult through standard network monitoring tools since the traffic appears normal until execution occurs within the victim's browser environment.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary and most effective solution is to upgrade the OWASP Dependency-Check plugin to version 5.6.5 or later, where this specific output encoding issue has been resolved by implementing strict HTML entity escaping for all user-supplied data rendered in the UI. Organizations should also enforce principle of least privilege within Jenkins by ensuring that Item/Configure permissions are granted only to trusted users and service accounts with a verified need for such access. Additionally, enabling Content Security Policy headers on the Jenkins instance can provide an additional layer of defense by restricting the sources from which scripts can be loaded or executed, thereby mitigating the impact even if similar vulnerabilities exist in other plugins. Regular auditing of plugin versions and configuration settings is essential to maintain a secure CI/CD pipeline environment against evolving web-based attack vectors.