CVE-2026-92140
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint.
Risk Assessment
An attacker can inject malicious JavaScript that executes in the browser of a Jenkins user viewing build causes, potentially leading to session theft or other actions in the victim's context.
Recommendation
Update Jenkins Gitee Plugin to a version newer than 1301.v8957053c7902, which includes the fix for escaping the sender name.
Other vulnerabilities in Jenkins Gitee Plugin
See all- CVE-2026-57293Medium
The Gitee Plugin in Jenkins version 1288.v18b_deb_c9069b_ and earlier has an incorrect permission check, allowing attackers with global Item/Configure permission to enumerate credential IDs stored in Jenkins.
- CVE-2026-57292Medium
The Gitee Plugin in Jenkins version 1288.v18b_deb_c9069b_ and earlier contains a CSRF vulnerability that allows attackers to connect to an attacker-specified URL using credentials IDs obtained through another method.
- CVE-2026-57291Medium
The Gitee Plugin in Jenkins version 1288.v18b_deb_c9069b_ and earlier has missing permission checks, allowing attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credential IDs obtained through another method.
Original NVD description (English source)
Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS