CVE-2018-1000604

5.4 mediumEPSS 0.7%

A persisted cross-site scripting vulnerability exists in Jenkins Badge Plugin 1.4 and earlier in BadgeSummaryAction.java, HtmlBadgeAction.java that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.

Severity

CVSS 3.0

5.4 medium

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2018-06-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

jenkins:badge

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-3xjq-8j89-xrw9	Maven	org.jenkins-ci.plugins:badge	<1.5	1.5

References

https://jenkins.io/security/advisory/2018-06-25/#SECURITY-906
https://jenkins.io/security/advisory/2018-06-25/#SECURITY-906

Check your stack JSON