CVE-2026-84665

The Jenkins SonarQube Scanner Plugin (2.18.3 and earlier) builds dashboard links from SonarQube scanner results without restricting the URL scheme, so a crafted result can inject a javascript: URL. An attacker who already holds Item/Configure permission on a Jenkins item can store such a link, and any user who clicks the dashboard link executes attacker-controlled JavaScript in their browser. Successful exploitation could allow session hijacking, credential theft, or actions taken as the victim within Jenkins. Any Jenkins instance running the affected plugin is exposed, though exploitation requires an insider or compromised account with item-configuration rights. No public proof-of-concept, KEV listing, or in-the-wild exploitation is known; EPSS estimates only a 0.2% chance of exploitation in the next 30 days.

What to do: Update the SonarQube Scanner plugin to the latest release available on the Jenkins update center (any version newer than 2.18.3). Limit Item/Configure permission to trusted users and audit existing dashboard links for javascript: URLs until remediation is complete. No public PoC or KEV listing exists, so urgent patching is not required, but treat the plugin as fixed in your next maintenance window.