Stored XSS via javascript: in Jenkins SonarQube Scanner Plugin <=2.18.3
CVE-2026-84665 Published on September 2, 2026

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the `javascript:` scheme, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-84665 can be exploited with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

What is a XSS Vulnerability?

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE-2026-84665 has been classified to as a XSS vulnerability or weakness.


Products Associated with CVE-2026-84665

Want to know whenever a new CVE is published for Jenkins? stack.watch will email you.

Jenkins
 

Affected Versions

Jenkins Project Jenkins SonarQube Scanner Plugin: