CoreCVE
Back

HIGH

Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allowing attackers to configure a custom SVG icon containing inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability

Published Sep 2, 2026

Description

Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allowing attackers to configure a custom SVG icon containing inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner jenkins
Published Sep 2, 2026
Updated Sep 2, 2026
Reserved Sep 1, 2026
Link CVE-2026-84673

CISA Vulnrichment

Updated Sep 2, 2026

NVD

Status Awaiting Analysis
Modified Sep 3, 2026
Link CVE-2026-84673

Red Hat

No data

ENISA EUVD

Assigner jenkins
Published Sep 2, 2026
Updated Sep 2, 2026
Link EUVD-2026-70146

GitHub

No data