CVE-2026-92135

The Jenkins Coverage Plugin fails to validate the coverage results ID supplied when a job configuration is submitted through the REST API, allowing an attacker with Item/Configure permission to store a URL using the javascript: scheme as the identifier. When other users subsequently view pages where that stored identifier is rendered, the embedded script executes in their browser session. Successful exploitation gives the attacker arbitrary script execution as the victim user, which can be used to steal sessions or credentials, modify Jenkins configurations, or perform actions with the victim's privileges. All Jenkins instances running Coverage Plugin 3.3358.v9487dde48783 or earlier are affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is currently known.

What to do: Upgrade the Coverage Plugin to a fixed release newer than 3.3358.v9487dde48783 as soon as it is available. Until then, restrict Item/Configure permission to trusted users only and audit existing job configurations (via the REST API or UI) for javascript: URLs in the coverage results ID field, removing any that are found. Treat unexpected coverage ID changes as suspicious, since this permission is normally limited to authorized project configurators.