CVE-2026-84665

8.0 highEPSS 0.4%

High (8.0). EPSS 0.4% chance of exploitation in the next 30 days.

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the `javascript:` scheme, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Severity

CVSS 3.1

8.0 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-09-02
Modified: 2026-09-03
Record from: the NVD, synced 2026-10-19

References

https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3989

Check your stack JSON