CVE-2019-10401: Improper Neutralization of Input During Web Page Generation in Jenkins
Summary
CVE-2019-10401: Improper Neutralization of Input During Web Page Generation in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.176.4
>= 2.177, < 2.197
Fixed in 2.176.4 or 2.197, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It is widely used for continuous integration and delivery. The vulnerable package, org.jenkins-ci.main:jenkins-core, is a core component of Jenkins responsible for its fundamental functionality.
Vulnerability Detail
The f:expandableTextBox form control in Jenkins versions 2.196 and earlier, LTS 2.176.3 and earlier, had a stored cross-site scripting (XSS) vulnerability. When the form control was expanded, it interpreted its content as HTML, allowing users with permission to define its contents (typically Job/Configure) to inject malicious scripts. This vulnerability could be exploited to execute arbitrary code in the context of other users, potentially leading to unauthorized access, data theft, or further compromise of the Jenkins server.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.176.42.176.4 -
>= 2.177, < 2.1972.197
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading immediately is not feasible, a temporary workaround is to restrict access to the f:expandableTextBox form control. This can be achieved by limiting the permission to define its contents only to trusted users or administrators. Additionally, input validation and sanitization should be implemented to prevent the execution of malicious scripts.
Conclusion
In conclusion, the Jenkins vulnerability CVE-2019-10401 allows for stored cross-site scripting (XSS) attacks, potentially leading to unauthorized access and data theft. It is crucial to upgrade Jenkins to the recommended versions or apply the provided workaround to mitigate the risk. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for continuous integration and delivery. It helps developers automate the building, testing, and deployment of their software projects.
The vulnerability allows users with permission to define the contents of the f:expandableTextBox form control to inject malicious scripts. This can lead to unauthorized access, data theft, or further compromise of the Jenkins server.
To fix this vulnerability, it is recommended to upgrade Jenkins to LTS 2.176.4 or later, or Jenkins 2.197 or later. Keeping Jenkins and its plugins up to date is crucial for maintaining a secure automation server.
A temporary workaround is to restrict access to the f:expandableTextBox form control by limiting the permission to define its contents only to trusted users or administrators. Input validation and sanitization should also be implemented to prevent the execution of malicious scripts.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
