CVE-2023-25762: Jenkins Pipeline Build Step Plugin stored XSS via unescaped job names

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityCVSS rates it medium (5.4) with required privileges and user interaction, but the very high EPSS score and stored nature warrant prompt patching.

What it is

Jenkins Pipeline: Build Step Plugin 2.18 and earlier fails to escape job names inside a JavaScript expression in the Pipeline Snippet Generator, creating a stored cross-site scripting flaw. An attacker who can control job names can plant script that runs in the browser of a user viewing the Snippet Generator, which matters because Jenkins sessions often carry broad build and administrative privileges.

Impact

An attacker gains script execution in the victim's Jenkins session, allowing actions as that user such as reading data, altering jobs, or performing privileged operations the victim is authorized for.

Attack surface

Reached over the network through the Jenkins web UI, specifically the Pipeline Snippet Generator rendering a malicious job name. The vector requires low privileges and user interaction (PR:L/UI:R), so the attacker needs an account able to set job names and must lure a user to the affected page.

Exploitation

Not listed in CISA KEV and no public exploit or exploitation tags appear in the references, but EPSS is high at 0.814 (99.6th percentile), indicating elevated predicted likelihood of exploitation activity.

What to do

• Upgrade Jenkins Pipeline: Build Step Plugin past version 2.18 to the fixed release named in the Jenkins security advisory 2023-02-15 (SECURITY-3019).
• If immediate upgrade is not possible, restrict who can create or rename jobs and limit access to the Pipeline Snippet Generator.
• Review and sanitize existing job names for HTML or JavaScript characters that could be rendered unescaped.
• Apply Content-Security-Policy headers on the Jenkins instance to reduce script execution impact.
• Audit Jenkins accounts for least privilege so a compromised session has limited reach.

Detection

• Search Jenkins job names and configuration for suspicious HTML or script payloads.
• Monitor Jenkins access logs for requests to the Pipeline Snippet Generator from unusual accounts or times.
• Alert on unexpected changes to job names or Pipeline configuration in Jenkins audit logs.
• Watch for outbound or injected script patterns in Jenkins HTTP responses tied to job name rendering.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.