CVE-2026-92140: Jenkins Gitee Plugin XSS Vulnerability

CVE-2026-92140 Overview

CVE-2026-92140 is a stored cross-site scripting (XSS) vulnerability in the Jenkins Gitee Plugin version 1301.v8957053c7902 and earlier. The plugin fails to escape the sender name from Gitee push webhook payloads when constructing build causes. An attacker able to trigger builds through the Jenkins Gitee Plugin webhook endpoint can inject arbitrary HTML or JavaScript that executes in the browser of Jenkins users viewing affected build metadata. The flaw is tracked under CWE-79 and documented in the Jenkins Security Advisory 2026-09-16.

Critical Impact
Successful exploitation allows attackers to execute script in the context of authenticated Jenkins users, potentially leading to session hijacking, unauthorized job execution, and credential theft.

Affected Products

Jenkins Gitee Plugin version 1301.v8957053c7902
All prior versions of the Jenkins Gitee Plugin
Jenkins controllers with the Gitee Plugin webhook endpoint reachable by attackers

Discovery Timeline

2026-09-16 - CVE-2026-92140 published to NVD
2026-09-16 - Jenkins Security Advisory SECURITY-4027 released
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92140

Vulnerability Analysis

The Jenkins Gitee Plugin integrates the Jenkins automation server with Gitee, processing webhook payloads that describe repository events such as pushes. When a push webhook arrives, the plugin records a build cause containing metadata about the event initiator, including the sender name. The plugin renders this sender name in the Jenkins web interface without applying HTML escaping. Because build causes appear on build detail pages, dashboards, and build history views, injected markup is stored server-side and served to any user viewing the affected build.

Root Cause

The root cause is missing output encoding for attacker-controlled webhook fields. The plugin trusts the sender name string from the Gitee push payload and inserts it directly into HTML output. Any user-supplied <script> tag, event handler, or HTML attribute injected into the sender name field persists as part of the build record.

Attack Vector

Exploitation requires that the attacker be able to send crafted push webhook payloads to the Jenkins Gitee Plugin webhook endpoint and trigger a build. The attacker submits a webhook payload with a malicious sender name value containing HTML or JavaScript. When a legitimate Jenkins user views the build cause in the Jenkins UI, the injected script executes in the user's authenticated session. This can be leveraged to perform actions on behalf of privileged users, exfiltrate CSRF tokens, or pivot to broader Jenkins administrative functions.

See the Jenkins Security Advisory 2026-09-16 for technical details.

Detection Methods for CVE-2026-92140

Indicators of Compromise

Webhook payloads to the Jenkins Gitee endpoint containing HTML tags, angle brackets, or JavaScript event handlers in the sender.name field
Build cause entries in Jenkins job history displaying unusual characters, encoded script fragments, or unexpected markup
Unexpected outbound HTTP requests from user browsers loading Jenkins build pages

Detection Strategies

Inspect Jenkins access logs for POST requests to the Gitee webhook endpoint originating from unauthorized sources
Query stored build metadata for sender name values containing <, >, javascript:, or on*= patterns indicative of HTML or script injection
Correlate anomalous browser sessions of Jenkins administrators with recent builds triggered by Gitee webhooks

Monitoring Recommendations

Enable audit logging on the Jenkins controller and forward events to a centralized log store for retrospective analysis
Monitor plugin inventory changes and track when the Gitee Plugin version is updated across Jenkins controllers
Alert on webhook payloads containing script-like tokens in text fields historically expected to hold plain identifiers

How to Mitigate CVE-2026-92140

Immediate Actions Required

Upgrade the Jenkins Gitee Plugin to the fixed release once available per the Jenkins Security Advisory
Restrict network access to the Jenkins Gitee webhook endpoint so only trusted Gitee source addresses can post payloads
Audit recent builds triggered by the Gitee Plugin for suspicious sender name values and remove affected build records

Patch Information

Refer to the Jenkins Security Advisory 2026-09-16 SECURITY-4027 for the fixed plugin version and upgrade guidance. Apply the update through the Jenkins Plugin Manager on all affected controllers.

Workarounds

Disable the Jenkins Gitee Plugin until the patched version is installed if webhook-triggered builds are not required
Place the Jenkins controller behind a reverse proxy that filters or rejects webhook payloads containing HTML metacharacters in sender fields
Enforce least-privilege permissions on Jenkins accounts to limit the impact of script execution in an authenticated session

bash

# Configuration example: restrict webhook endpoint by source IP at reverse proxy
# Example nginx snippet - replace with authorized Gitee source ranges
location /gitee-project/ {
    allow 212.64.0.0/17;
    deny all;
    proxy_pass http://jenkins_upstream;
}