CVE-2022-34176: Jenkins JUnit Plugin stored XSS via unescaped test result descriptions

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityCVSS rates it medium at 5.4 and exploitation requires authenticated Run/Update permission plus victim interaction, though the very high EPSS score warrants prompt patching.

What it is

The Jenkins JUnit Plugin up to 1119.va_a_5e9068da_d7 fails to escape descriptions of test results, creating a stored cross-site scripting flaw. An attacker with Run/Update permission can plant script that executes in the browser of anyone viewing the affected test results, which matters because Jenkins sessions often carry broad build and administrative access.

Impact

An attacker can run arbitrary JavaScript in a victim's Jenkins session, enabling session theft, credential capture, or actions performed as the victim. The scope change in the CVSS vector indicates the injected content can affect resources beyond the vulnerable component.

Attack surface

Reached over the network through the Jenkins web UI where test result descriptions are rendered; the attacker needs Run/Update permission and the victim must view the crafted content, so user interaction is required.

Exploitation

Not listed in CISA KEV and no public exploit references are provided, but EPSS is very high at 0.78 (99.5th percentile), suggesting elevated likelihood of attempted exploitation.

What to do

• Upgrade the Jenkins JUnit Plugin to a version after 1119.va_a_5e9068da_d7 that escapes test result descriptions.
• Restrict Run/Update permission to trusted users and review who currently holds it.
• Apply output encoding or sanitization to test result descriptions if any custom rendering is in place.
• Monitor Jenkins security advisories for follow-up fixes or related plugin issues.

Detection

• Search Jenkins logs and build records for test result descriptions containing script tags or HTML event handlers.
• Review audit logs for Run/Update permission changes or unusual build updates by low-trust accounts.
• Inspect HTTP traffic to Jenkins for reflected or stored script payloads in test result views.
• Alert on anomalous browser-side activity or session use originating from Jenkins users who viewed test results.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.