CVE-2026-92136

The OWASP Dependency-Check Plugin for Jenkins up to and including version 5.6.4 fails to escape CWE values taken from Dependency-Check reports before rendering them in the Jenkins UI, enabling a stored cross-site scripting (XSS) vulnerability. An attacker who already holds Item/Configure permission on a Jenkins job can inject a malicious payload into the report data so that it persists and executes whenever other users view the report in the web interface. A successful attack lets the attacker run arbitrary script in the victim's browser session, potentially hijacking sessions and performing actions with the victim's Jenkins privileges. Any Jenkins controller running the affected plugin is exposed, particularly multi-user controllers where report viewers are not the same users who configure jobs. No exploitation in the wild or public proof-of-concept is currently known.

What to do: Update the OWASP Dependency-Check Plugin to the latest patched release available from the Jenkins update center (all versions 5.6.4 and earlier are affected). Limit Item/Configure permission to trusted users and review recent job configuration changes for unexpected report content. Treat viewing of Dependency-Check reports in the Jenkins UI with caution until the plugin is patched.