Stored Cross-Site Scripting Vulnerability in Jenkins Buildgraph-View Plugin
CVE-2026-48927

5.5MEDIUM

Key Information:

Vendor

Jenkins
Status
Jenkins Buildgraph-view Plugin
Vendor
CVE Published:
27 May 2026

What is CVE-2026-48927?

The Jenkins Buildgraph-View Plugin versions 1.8 and earlier are vulnerable to a stored cross-site scripting (XSS) attack. This vulnerability arises from the failure to properly escape the build URL, allowing attackers who can configure jobs or views to inject malicious scripts. Such scripts could be executed within the context of a victim's browser, potentially compromising their data and session.

Affected Version(s)

Jenkins buildgraph-view Plugin 0 <= 1.8

References

https://www.jenkins.io/security/advisory/2026-05-27/#SECU...
vendor-advisory

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.