GHSA-85h6-5m3v-gx37
High · 8.0CVSS
8.0
EPSS
—
Published
Feb 18, 2026
CISA due date
—
The record
Jenkins has a stored XSS vulnerability in node offline cause description
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | 2.483 | 2.541.2 |
| Maven | org.jenkins-ci.main:jenkins-core | 2.542 | 2.551 |
Related vulnerabilities
- CVE-2026-27099 Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both… Same vulnerability
- GHSA-wfhp-qgm8-5p5c Jenkins has a build information disclosure vulnerability through Run Parameter Also affects org.jenkins-ci.main:jenkins-core
- CVE-2026-27100 Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that… Also affects org.jenkins-ci.main:jenkins-core
- GHSA-6837-qgrc-x5p6 Jenkins has a CSRF vulnerability on the login form Also affects org.jenkins-ci.main:jenkins-core
- GHSA-9p56-p6mw-w8qc Jenkins has a Denial of service vulnerability in HTTP-based CLI Also affects org.jenkins-ci.main:jenkins-core
- GHSA-fxj7-6v9w-xc76 Jenkins's build authorization token is stored and displayed in plain text Also affects org.jenkins-ci.main:jenkins-core
- GHSA-hxjg-2jvf-h3rx Jenkins's build authorization token is stored and displayed in plain text Also affects org.jenkins-ci.main:jenkins-core
- GHSA-p3f5-98cv-562j Jenkins is missing a permission check on password fields Also affects org.jenkins-ci.main:jenkins-core