CVE-2019-10349: Jenkins Dependency Graph Viewer Plugin contains Cross-site Scripting
Summary
CVE-2019-10349: Jenkins Dependency Graph Viewer Plugin contains Cross-site Scripting. Affects org.jenkins-ci.plugins:depgraph-view versions < 0.14. Fixed in 0.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Dependency Graph Viewer Plugin is a plugin for the Jenkins automation server that provides a visual representation of the dependencies between jobs. It allows users to view and analyze the relationships between different jobs in a Jenkins instance. The plugin is an integral part of Jenkins and is widely used by developers and administrators to understand and manage complex job dependencies.
Vulnerability Detail
The Jenkins Dependency Graph Viewer Plugin version 0.13 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. This vulnerability allows attackers with the ability to configure jobs in Jenkins to inject arbitrary HTML and JavaScript code into the plugin-provided web pages. An attacker could exploit this vulnerability to execute malicious code in the context of other users who view the affected web pages. This could lead to various security risks, including the theft of sensitive information, session hijacking, and unauthorized actions.
How To Fix
Latest published version: 1.0.5 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.14
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of the plugin as soon as possible.
Conclusion
The Jenkins Dependency Graph Viewer Plugin version 0.13 and earlier is vulnerable to a stored cross-site scripting attack. To mitigate this vulnerability, users should upgrade to version 0.14 or later of the plugin. It is important to stay updated with the latest security patches and follow best practices to ensure the security of Jenkins instances. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:depgraph-view →
FAQ
This vulnerability allows attackers to inject malicious code into Jenkins web pages, potentially leading to the execution of arbitrary code in the context of other users. This can result in the theft of sensitive information, session hijacking, and unauthorized actions.
Users of Jenkins who have the Dependency Graph Viewer Plugin version 0.13 or earlier installed are affected by this vulnerability.
There is no known public exploit for this vulnerability at the time of this report. However, it is advisable to upgrade to the latest version of the plugin to mitigate the risk.
The only effective mitigation for this vulnerability is to upgrade to version 0.14 or later of the Jenkins Dependency Graph Viewer Plugin.
For more information about this vulnerability, you can refer to the GitHub advisory database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-4wj7-rh5h-5qmr/GHSA-4wj7-rh5h-5qmr.json
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:depgraph-view.
