CVE-2026-92140

Executive Summary

CVE-2026-92140 is a stored cross-site scripting (XSS) vulnerability in the Jenkins Gitee Plugin versions 1301.v8957053c7902 and earlier. The plugin fails to escape the sender name field from Gitee push webhook payloads when rendering build causes, allowing an attacker with the ability to trigger builds via the Jenkins Gitee Plugin webhook endpoint to inject persistent JavaScript. Successful exploitation executes arbitrary script in the context of authenticated Jenkins users viewing affected build pages, potentially leading to privilege escalation, credential theft, and full Jenkins controller compromise.

Technical Analysis

The vulnerability exists in the Jenkins Gitee Plugin, which integrates Jenkins with the Gitee source code hosting platform. Gitee, similar to GitHub, provides webhook functionality that notifies Jenkins of repository events such as push operations. When a push event occurs, Gitee sends a JSON payload to the configured Jenkins webhook endpoint, containing metadata about the push including the sender's name.

The core flaw is CWE-79 (Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting). The plugin extracts the sender name from the incoming webhook payload and stores it as part of the build cause record — the human-readable explanation shown on a build's page indicating why that build was triggered (e.g., "Started by Gitee push by [sender_name]"). Critically, this value is not HTML-encoded or otherwise sanitized before being persisted. When Jenkins later renders the build cause on its web interface (build status pages, build history, job pages), the unescaped payload is interpreted by the browser as HTML/JavaScript rather than inert text.

Because the malicious payload is stored server-side in the build cause metadata, this is a stored (persistent) XSS, not a reflected one. Every subsequent page view by any authorized user displaying that build cause will trigger the injected script. The attack surface is the Jenkins Gitee Plugin webhook endpoint — the network-reachable HTTP listener that processes incoming Gitee push notifications.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) indicates:

• AV:N (Network) — exploitable remotely over the network via the webhook HTTP endpoint.
• AC:L (Low) — no special conditions beyond normal webhook operation.
• PR:H (High) — the attacker must possess the ability to trigger builds or supply webhook payloads, implying elevated pre-conditions such as knowledge of the webhook URL/secret or the ability to send a forged push event.
• UI:R (User Interaction Required) — a victim must view the affected page for the script to execute.
• S:U (Unchanged) — the vulnerable component's security scope is not exceeded; impact stays within Jenkins' security authority.
• C:H / I:H / A:H — high confidentiality, integrity, and availability impact, reflecting that script execution in the Jenkins UI context can read secrets, alter configuration, and disrupt CI/CD operations.

The combination of PR:H and UI:R explains the moderate 6.8 base score. There is no public proof-of-concept, no Nuclei template, and no CISA KEV listing as of this report. Patch confidence is 0/4 — no vendor patch, advisory, or fix version has been identified.

Exploitation Scenarios

No public exploitation code exists. The following chain is inferred from the stored-XSS vulnerability class and the specific attack surface described in the NVD record. All identifiers referenced (sender name, Gitee push webhook payloads, build causes, Jenkins Gitee Plugin webhook endpoint) are taken verbatim from the description; no additional implementation details are fabricated.

1) Reconnaissance / target identification An attacker identifies Jenkins instances exposing the Gitee Plugin webhook endpoint. Publicly reachable Jenkins controllers, or those where the attacker has network access to the endpoint, are candidates. The attacker determines the webhook URL (typically referenced in the Gitee repository's webhook configuration) and whether it can deliver a crafted push payload — either through direct HTTP requests to the endpoint or by exercising a repository they control that is wired to the target's Gitee integration.

2) Triggering the flaw The attacker crafts a Gitee-style push webhook payload in which the sender name field contains a malicious HTML/JavaScript string (e.g., a <script> tag or an event-handler-bearing element). Delivering this payload to the Jenkins Gitee Plugin webhook endpoint causes Jenkins to accept it as a legitimate push event and initiate a build. The plugin records a build cause containing the unescaped sender name.

3) Payload execution The malicious sender name is stored server-side as part of the build cause. No script executes at this stage — the payload is inert until rendered. When any authenticated Jenkins user navigates to a page that displays that build's cause (such as the build history or a specific build's status page), the browser parses the stored cause string as HTML. The injected script executes in the origin of the Jenkins web UI, under that user's authenticated session.

4) Post-exploitation impact Because execution occurs in the Jenkins UI origin, the script can act with the victim's privileges. Typical consequences at the vulnerability-class level include: exfiltrating session cookies or API tokens; reading build logs, credentials, or secrets the victim can access; performing actions on the victim's behalf (creating users, modifying jobs, changing configuration); and, if the victim is an administrator, enabling escalation to full Jenkins controller compromise. The high C/I/A subscores reflect this worst-case, admin-viewer scenario.

Impact Assessment

The Jenkins controller is the authoritative orchestration point for an organization's CI/CD pipeline. A stored XSS in this context is far more consequential than in an ordinary web application:

• Confidentiality (C:H): Script running in the Jenkins UI origin can read secrets, credentials, source code, and API tokens accessible to the viewing user. Jenkins frequently holds deployment keys and cloud credentials.
• Integrity (I:H): Attackers can alter jobs, build scripts, and configuration through the victim's session, or inject malicious build steps — a path to software supply-chain compromise.
• Availability (A:H): Build pipelines can be disrupted, jobs deleted, or the controller destabilized.

The blast radius scales with the privilege of the users who view the poisoned build cause. In many organizations, administrators routinely browse build pages, meaning exploitation can yield administrative-level control. The PR:H requirement means the attacker must already be able to trigger builds via the webhook (e.g., control over a wired Gitee repository or the ability to forge webhook requests), which limits trivial unauthenticated exploitation but does not reduce the severity once triggered. A single successfully injected sender name can persist indefinitely across the visible build history, affecting every user who views it.

No EPSS score is currently assigned by FIRST.org, and the CVE is not in CISA KEV; there is no observed exploitation in the wild as of this writing.

Detection Guidance

Sigma Rule

title: Jenkins Gitee Plugin Stored XSS via Webhook Sender Name
id: 9f3c1a7e-4b2d-4e6a-9c11-2026abc92140
status: experimental
description: Detects HTTP requests to the Jenkins Gitee Plugin webhook endpoint containing HTML/script characters in payload fields, indicating attempted stored XSS injection via the sender name.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92140
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: jenkins
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - 'gitee'
      - 'webhook'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - '%3Cscript'
      - 'onerror='
      - 'onload='
      - 'javascript:'
  condition: selection_endpoint and selection_payload
falsepositives:
  - Legitimate repository names or commit messages containing HTML-like text
level: high

YARA Rule

rule CVE_2026_92140_Jenkins_Gitee_XSS
{
    meta:
        description = "Detects stored XSS payloads targeting Jenkins Gitee Plugin build causes via unescaped sender name"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92140"
        date = "2026-01-01"
        cve = "CVE-2026-92140"
    strings:
        $a = "<script" nocase
        $b = "onerror=" nocase
        $c = "onload=" nocase
        $d = "javascript:" nocase
        $e = "<img src=x" nocase
        $f = "sender_name" nocase
        $g = "sender" nocase
    condition:
        (uint16(0) == 0x7B7B or true) and
        any of ($a, $b, $c, $d, $e) and any of ($f, $g)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92140 Jenkins Gitee Plugin Stored XSS via Sender Name Injection"; flow:to_server,established; http.uri; content:"gitee"; nocase; http.request_body; content:"sender"; nocase; content:"<script"; nocase; http.request_body; content:"<script"; nocase; http.request_body; content:"onerror="; nocase; http.request_body; content:"onload="; nocase; http.request_body; content:"javascript:"; nocase; classtype:web-application-attack; reference:cve,2026-92140; sid:202692140; rev:1;)

Elastic Detection

sequence by host.id
  [network where http.request.method == "POST" and
     stringContains(http.request.uri, "gitee") and
     (stringContains(http.request.body, "<script") or
      stringContains(http.request.body, "onerror=") or
      stringContains(http.request.body, "javascript:"))]

Splunk SPL Query

index=web OR index=jenkins sourcetype=access_common OR sourcetype=jenkins:*
| eval payload = uri . " " . coalesce(request_body, form_data, "")
| where (match(uri, "(?i)gitee") OR match(uri, "(?i)webhook"))
    AND (match(payload, "(?i)<script") OR match(payload, "(?i)onerror=") OR match(payload, "(?i)onload=") OR match(payload, "(?i)javascript:"))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, host
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,jenkins,cve-2026-92140,">
  <rule id="2026921" level="12">
    <if_sid>31100</if_sid>
    <field name="url">(?i)gitee|webhook</field>
    <field name="url|request_body">(?i)&lt;script|onerror=|onload=|javascript:</field>
    <description>CVE-2026-92140: Potential stored XSS injection via Jenkins Gitee Plugin webhook sender name</description>
    <mitre>
      <id>T1190</id>
      <id>T1059.007</id>
    </mitre>
    <group>cve_2026_92140,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations

• Restrict network access to the Jenkins Gitee Plugin webhook endpoint so only trusted Gitee egress IPs can reach it; block direct external POSTs.
• If Gitee integration is not operationally required, disable or uninstall the Gitee Plugin.
• Require authentication or a shared secret on the webhook path where the plugin supports it, and rotate any exposed webhook secrets.
• Sanitize/validate inbound webhook payloads at the network edge — strip or reject sender names containing HTML/script characters.
• Enforce a restrictive Content-Security-Policy on the Jenkins UI to reduce script-execution impact, and treat untrusted build-cause content as inert.

2) Patch/upgrade steps

• No vendor fix has been published. Monitor the Jenkins Security Advisories page and the Gitee Plugin update center for a fixed release.
• Once a patched plugin version is released, upgrade via Jenkins Manage Jenkins → Plugins and restart the controller.
• In the interim, do not assume any version up to and including 1301.v8957053c7902 is safe.

3) Long-term hardening

• Sanitize all externally sourced strings (webhook payloads, commit messages, usernames) with contextual HTML encoding before rendering.
• Adopt a secure software development training program covering output encoding and stored-XSS prevention.
• Continuously inventory and remove unused Jenkins plugins to reduce attack surface.
• Apply least privilege to Jenkins users and monitor plugin advisory feeds for regression.

References

• NVD — CVE-2026-92140: https://nvd.nist.gov/vuln/detail/CVE-2026-92140
• Jenkins Security Advisories: https://www.jenkins.io/security/advisories/
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• MITRE CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor attribution: none available. No exploit-in-the-wild evidence, no public PoC, no Nuclei template, and no CISA KEV entry as of this report.