CVE-2026-84665 — Jenkins Project / Jenkins SonarQube Scanner Plugin

CVE-2026-84665

Jenkins Project / Jenkins SonarQube Scanner Plugin PUBLISHED

Description (CNA)

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the `javascript:` scheme, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Affected (CNA)

Vendor / product	Versions
Jenkins Project / Jenkins SonarQube Scanner Plugin	affected 0 through 2.18.3

CWE

No CWE identifiers supplied.

References

https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3989

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.