CVE-2026-92134

The Jenkins Warnings Plugin fails to validate the analysis results ID when a job configuration is submitted, including through the REST API. An attacker holding Item/Configure permission on a job can set the identifier to a URL using the javascript: scheme, which is then stored and rendered to other users, executing as a stored cross-site scripting (XSS) attack. Successful exploitation lets the attacker run arbitrary JavaScript in the browsers of other Jenkins users, enabling actions taken as the victim, session hijacking, and potential exposure of credentials or data readable in the victim's session (CVSS 8.0 high). Any Jenkins controller running Warnings Plugin 13.10258.va_17d49a_78c3b_ or earlier is affected, with the highest risk where Configure permissions are broadly granted or the REST API is used for job management. No public proof-of-concept or exploitation in the wild is currently known, and the flaw is not listed in CISA's KEV catalog.

What to do: Upgrade the Jenkins Warnings Plugin to the newest release published after this advisory (versions 13.10258.va_17d49a_78c3b_ and earlier are vulnerable). In the meantime, limit Item/Configure permission to trusted users and restrict REST API access to job configuration. Audit existing job configurations for analysis results IDs set to javascript: or other unexpected URL schemes and remove them.