PT-2026-93783 · Jenkins · Gitee Plugin
CVE-2026-92140
·
Published
2026-09-16
·
Updated
2026-09-16
CVSS v3.1
6.8
Medium
| Vector | AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Jenkins Gitee Plugin versions prior to 1301.v8957053c7902
Description
Stored cross-site scripting (XSS) occurs because the plugin fails to escape the sender name within Gitee push webhook payloads in build causes. This allows attackers who can trigger builds via the Jenkins Gitee Plugin webhook endpoint to execute malicious scripts in the context of the user's session.
Recommendations
Update Jenkins Gitee Plugin to a version later than 1301.v8957053c7902.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gitee Plugin