CVE-2019-10410: Jenkins Log Parser Plugin Cross-site Scripting Vulnerability
Summary
CVE-2019-10410: Jenkins Log Parser Plugin vulnerable to Cross-site Scripting. Affects org.jenkins-ci.plugins:log-parser versions < 2.1. Fixed in 2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Log Parser Plugin is a Jenkins plugin that allows users to parse the console output of Jenkins jobs and trigger actions based on specific patterns found in the logs. It provides a flexible way to extract information from build logs and take actions accordingly. The plugin is widely used in Jenkins environments for log analysis and automation.
Vulnerability Detail
The Log Parser Plugin in versions prior to 2.1 is vulnerable to a cross-site scripting (XSS) attack. When log parsing patterns are invalid, an error message is displayed without proper escaping, allowing an attacker with control over the log parsing rules configuration to inject malicious scripts. This vulnerability can be exploited by users with Job/Configure permission. The XSS attack can lead to unauthorized access, data theft, and potential compromise of the Jenkins environment.
How To Fix
Latest published version: 3.0.7 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to restrict access to the log parsing rules configuration. Limiting the Job/Configure permission to trusted users can help mitigate the risk of exploitation. Additionally, regular monitoring of the Jenkins environment for any suspicious activity is advised.
Conclusion
The Log Parser Plugin in Jenkins versions prior to 2.1 is vulnerable to a cross-site scripting attack. Upgrading to version 2.1 or newer is recommended to fix this vulnerability. Restricting access to the log parsing rules configuration and monitoring the Jenkins environment can provide temporary mitigation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:log-parser →
FAQ
The vulnerability allows an attacker to inject malicious scripts into the error message displayed when log parsing patterns are invalid. This can lead to unauthorized access, data theft, and potential compromise of the Jenkins environment.
Users with Job/Configure permission and control over the log parsing rules configuration can exploit this vulnerability.
No, Jenkins versions 2.146 and LTS 2.138.2 onwards have the necessary escaping in place to prevent this vulnerability.
Yes, upgrading to Log Parser Plugin version 2.1 or newer fixes this vulnerability.
Restricting access to the log parsing rules configuration and monitoring the Jenkins environment for suspicious activity can serve as temporary workarounds.
