~ / search / GHSA-j4wf-9gx8-63f8

GHSA-j4wf-9gx8-63f8

Jenkins Applitools Eyes Plugin vulnerable to XSS through its Build page

Source: GitHub Advisory Database (reviewed) High CVE-2025-53658

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:applitools-eyes < 1.16.6 1.16.6

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not escape the Applitools URL on the build page. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Applitools Eyes Plugin 1.16.6 rejects Applitools URLs that contain HTML metacharacters.

References

External links from the advisory. They lead to third-party sites.