GHSA-v3f3-rf6r-43x5

Jenkins Coverage Plugin has a stored cross-site scripting (XSS) vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2025-67641

Packages

Ecosystem	Package	Affected	Fixed in
Maven	io.jenkins.plugins:coverage	< 2.3056	2.3056

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-67641 advisory
https://github.com/jenkinsci/coverage-plugin/commit/1dfe888b02499d39185397862cf2790efc03e955 web
https://github.com/jenkinsci/coverage-plugin package
https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3611 web