CVE-2025-5806: Jenkins Gatling Plugin XSS Vulnerability

CVE-2025-5806 Overview

CVE-2025-5806 is a stored cross-site scripting (XSS) vulnerability in the Jenkins Gatling Plugin version 136.vb_9009b_3d33a_e. The plugin serves Gatling reports in a way that bypasses the Content-Security-Policy (CSP) protection introduced in Jenkins 1.641 and 1.625. Attackers with permission to modify report content can inject malicious scripts that execute in the browsers of other Jenkins users. The flaw is tracked under CWE-79 and disclosed in the Jenkins Security Advisory SECURITY-3588.

Critical Impact
Authenticated users with the ability to change Gatling report content can execute arbitrary JavaScript in the context of the Jenkins web interface, enabling session theft, privilege escalation, and pipeline tampering.

Affected Products

Jenkins Gatling Plugin 136.vb_9009b_3d33a_e
Jenkins controllers hosting the vulnerable plugin
Gatling report artifacts served through Jenkins

Discovery Timeline

2025-06-06 - Jenkins publishes security advisory SECURITY-3588
2025-06-06 - CVE-2025-5806 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5806

Vulnerability Analysis

The Jenkins Gatling Plugin renders performance test reports directly through the Jenkins web interface. Jenkins 1.625 and 1.641 introduced a Content-Security-Policy header applied to user-generated content served via DirectoryBrowserSupport. This CSP restricts inline scripts, styles, and remote resource loading to prevent stored XSS through artifacts and workspace files.

The Gatling Plugin serves its reports through a mechanism that does not enforce the Jenkins CSP header. As a result, HTML content within Gatling reports can include arbitrary JavaScript that executes when a user views the report. The vulnerability is classified as XSS under [CWE-79] and requires authenticated access with permission to alter report content.

Successful exploitation runs attacker-controlled script in the victim's browser session with Jenkins authentication cookies. This enables job manipulation, credential exfiltration through the Jenkins credentials API, and lateral movement into connected build agents.

Root Cause

The root cause is a missing or bypassed CSP enforcement path when the plugin serves Gatling HTML reports. Jenkins core relies on DirectoryBrowserSupport to attach a restrictive CSP to artifact responses. The Gatling Plugin uses a custom serving mechanism that does not inherit this header, leaving report HTML free to load and execute inline scripts.

Attack Vector

An attacker with Item/Configure or equivalent permission on a Jenkins job modifies the Gatling report content, either by altering test scenarios that produce report output or by directly manipulating the report artifacts on disk or in source control. When another Jenkins user, including administrators, opens the report through the Jenkins UI, the injected script executes with the victim's session privileges. The vulnerability requires network access to Jenkins and user interaction to view the report.

No public proof-of-concept exploit is available, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.444%, indicating low predicted exploitation activity.

Detection Methods for CVE-2025-5806

Indicators of Compromise

Unexpected <script> tags, event handlers, or javascript: URIs inside Gatling report HTML files within Jenkins job workspaces or archived artifacts.
Outbound HTTP requests from Jenkins user browsers to unfamiliar domains immediately after viewing a Gatling report.
Modifications to Gatling report templates or simulation files committed by low-privilege users outside normal change windows.

Detection Strategies

Scan archived Gatling report artifacts for HTML content containing inline JavaScript, iframe injections, or references to external script sources.
Review Jenkins audit logs for Item/Configure actions on jobs that produce Gatling reports, correlating with subsequent report views by privileged users.
Compare deployed Gatling Plugin versions across the Jenkins fleet against the fixed release announced in SECURITY-3588.

Monitoring Recommendations

Alert on CSP violation reports originating from Jenkins URLs, which can surface injected script attempts even when execution is blocked.
Monitor Jenkins reverse proxy logs for anomalous request patterns to /job/*/gatling/ paths.
Track plugin inventory changes and flag Jenkins instances still running Gatling Plugin 136.vb_9009b_3d33a_e.

How to Mitigate CVE-2025-5806

Immediate Actions Required

Upgrade the Jenkins Gatling Plugin to a version released after 136.vb_9009b_3d33a_e that addresses SECURITY-3588 as soon as it is available.
Restrict Item/Configure and job creation permissions to trusted users using the Jenkins matrix authorization strategy.
Audit existing Gatling report artifacts for injected script content and quarantine suspicious reports.

Patch Information

Refer to the Jenkins Security Advisory SECURITY-3588 for the fixed plugin version and upgrade instructions. Apply the patched release through the Jenkins Plugin Manager and restart the controller to activate the fix.

Workarounds

Disable the Gatling Plugin until the patched version can be installed, removing the vulnerable report-serving endpoint.
Apply the Jenkins Resource Root URL configuration to serve user-generated content from a separate domain, isolating report scripts from the main Jenkins session cookie.
Enforce least-privilege access on jobs that produce Gatling reports and require code review for changes to simulation scripts and report templates.

bash

# List installed Jenkins plugins and identify the vulnerable Gatling version
curl -s -u "$JENKINS_USER:$JENKINS_TOKEN" \
  "$JENKINS_URL/pluginManager/api/json?depth=1" \
  | jq '.plugins[] | select(.shortName=="gatling") | {shortName, version, enabled}'

# Disable the plugin as a temporary workaround
curl -X POST -u "$JENKINS_USER:$JENKINS_TOKEN" \
  "$JENKINS_URL/pluginManager/plugin/gatling/makeDisabled"