8.0 High

CVE-2026-84665 Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates…

Description

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the `javascript:` scheme, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins SonarQube Scanner Plugin 2.18	earliest → 2.18.3	No fix stated

Do you use Jenkins SonarQube Scanner Plugin?

Track this CVE Watch Jenkins SonarQube Scanner Plugin Check my SBOMs

www.cveye.io/en/cve/CVE-2026-84665

Timeline

Published September 2, 2026
Last modified September 2, 2026

References

Jenkins Security Advisory 2026-09-02 www.jenkins.io

Track this CVE