CVE-2026-92140

The Jenkins Gitee Plugin fails to escape the sender name taken from Gitee push webhook payloads when it is rendered in build causes, allowing malicious script to be stored in Jenkins. An attacker who is able to trigger builds through the plugin's webhook endpoint can submit a crafted Gitee push payload whose sender name contains JavaScript. When a Jenkins user later views the affected build cause, the injected script runs in their browser session, potentially enabling credential theft or unauthorized actions in the Jenkins UI (CVSS rates confidentiality, integrity and availability impacts as high, though user interaction and high privileges are required). Any Jenkins instance running Gitee Plugin version 1301.v8957053c7902 or earlier is affected. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and there are no reports of exploitation in the wild.

What to do: Update the Gitee Plugin to the newest release published after 1301.v8957053c7902 (see the corresponding Jenkins security advisory). Until then, restrict the webhook endpoint to trusted Gitee sources (e.g., require authentication or network allow-listing) and treat build cause data as untrusted. Check Jenkins instances for the plugin via the plugin manager and review recent builds triggered by the Gitee webhook for suspicious sender names.