Medium severity6.1OSV Advisory· Published Jan 9, 2019· Updated Jun 17, 2026

CVE-2018-1000426

Description

A cross-site scripting vulnerability exists in Jenkins Git Changelog Plugin 2.6 and earlier in GitChangelogSummaryDecorator/summary.jelly, GitChangelogLeftsideBuildDecorator/badge.jelly, GitLogJiraFilterPostPublisher/config.jelly, GitLogBasicChangelogPostPublisher/config.jelly that allows attackers able to control the Git history parsed by the plugin to have Jenkins render arbitrary HTML on some pages.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
de.wellnerbou.jenkins:git-changelogMaven	< 2.7	2.7

Affected products

Jenkins Project/Git Changelog PluginOSV
Range: 1.0, 1.22, git-changelog-1.1, …
Jenkins Project/Git Changelog
cpe:2.3:a:jenkins:git_changelog:*:*:*:*:*:jenkins:*:*
Range: <=2.6
ghsa-coords
pkg:maven/de.wellnerbou.jenkins/git-changelog
Range: < 2.7

Patches

Vulnerability mechanics

References

www.securityfocus.com/bid/106532nvdThird Party AdvisoryVDB EntryWEB
github.com/advisories/GHSA-jcmg-9rw5-9rm2ghsaADVISORY
jenkins.io/security/advisory/2018-09-25/nvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2018-1000426ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000