CVE-2019-10374
Description
Stored XSS in Jenkins PegDown Formatter Plugin allows attackers to inject JavaScript links via markup fields.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Stored XSS in Jenkins PegDown Formatter Plugin allows attackers to inject JavaScript links via markup fields.
Vulnerability
CVE-2019-10374 is a stored cross-site scripting (XSS) vulnerability in the Jenkins PegDown Formatter Plugin versions 1.3 and earlier. The plugin fails to sanitize user-supplied markup, allowing attackers to insert links with the javascript: scheme into fields rendered by the configured markup formatter [1][2][3].
Exploitation
An attacker with the ability to edit descriptions or other fields that use the markup formatter can inject malicious JavaScript code. No special authentication is required beyond standard Jenkins edit permissions, making it exploitable by any user who can modify such fields [1].
Impact
Successful exploitation leads to arbitrary JavaScript execution within the Jenkins UI, potentially allowing attackers to steal session cookies, perform actions on behalf of victims, or deface the interface. The malicious code would execute when other users view the affected content [3].
Mitigation
The PegDown Formatter Plugin is deprecated and archived; users should migrate to the markdown-formatter plugin [4]. No official patch was released for this vulnerability as the plugin is no longer maintained. As a workaround, administrators can disable the plugin or restrict permissions to trusted users only [2].
AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.jenkins-ci.plugins:pegdown-formatterMaven | <= 1.3 | — |
Affected products
2- Range: 1.3 and earlier
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/advisories/GHSA-922h-x9qv-2274ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2019-10374ghsaADVISORY
- www.openwall.com/lists/oss-security/2019/08/07/1ghsamailing-listx_refsource_MLISTWEB
- jenkins.io/security/advisory/2019-08-07/ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.