CVE-2026-53441

Vulnerability

Jenkins versions 2.483 through 2.567 and LTS 2.492.1 through 2.555.2 are affected by a stored cross-site scripting (XSS) vulnerability. This flaw exists because the user-provided description for a generic offline cause, which can be set via the POST config.xml API, is not properly escaped. [1]

Exploitation

An attacker with the Agent/Configure permission can exploit this vulnerability. The attacker needs to be able to POST to the config.xml API. By providing a malicious description for a generic offline cause, the attacker can inject script that will be executed in the browser of other users who view the affected configuration. [1]

Impact

Successful exploitation of this vulnerability results in stored XSS. This means that malicious scripts are stored within Jenkins and executed when other users interact with the affected configuration. The impact is limited to users who view the configuration, and the attacker gains the ability to execute arbitrary JavaScript in the context of the victim's browser session. [1]

Mitigation

This vulnerability is fixed in Jenkins 2.568 and LTS 2.555.3. Users are advised to update to these versions or later. No workarounds are specified in the available references. [1]