6.8
Medium
CVE-2026-92140 Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads…
Description
Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins Gitee Plugin 1301 | earliest → 1301.v8957053c7902 | No fix stated |
Other CVEs of Jenkins Gitee Plugin
The 4 CVEs of Jenkins Gitee Plugin →
CVE-2026-57293
An incorrect permission check in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers with global…
4.3
Medium
CVE-2026-57291
Missing permission checks in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allow attackers with Overall/Read…
5.4
Medium
CVE-2026-57292
A cross-site request forgery (CSRF) vulnerability in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows…
5.4
Medium