Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
CVE-2026-53441: Jenkins lets malicious script run via offline cause
CVE-2026-53441 · published 4 months ago
Summary
Jenkins versions from 2.483 to 2.567 (and LTS 2.492.1 to 2.555.2) can store a user‑provided description without cleaning it, so a crafted script can be saved and later executed in a browser. An attacker who can change agent settings could inject code that runs for anyone viewing the page. Update Jenkins to a patched version or apply the vendor’s recommended fix to sanitize input.
What to do
- Update jenkins-ci org.jenkins-ci.main:jenkins-core to version 2.568.
- Update jenkins to version 2.568.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | jenkins-ci | org.jenkins-ci.main:jenkins-core |
>= 2.483, <= 2.567 Fix: upgrade to 2.568
|
| – | jenkins | jenkins |
>= 2.483, < 2.568 >= 2.492.1, < 2.555.3 cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:* |
| Bitnami | – | jenkins |
>= 2.556.0, < 2.568.0 Fix: upgrade to 2.568.0
|
Original advisory text
Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the `PO...
Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the `POST config.xml` API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
5.4
Medium
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published10 Jun 2026
Updated4 Nov 2026
First seen10 Jun 2026
Track software like this
Free during beta