CVE-2022-23108: Stored XSS vulnerability in Jenkins Badge Plugin
Summary
CVE-2022-23108: Stored XSS vulnerability in Jenkins Badge Plugin. Affects org.jenkins-ci.plugins:badge versions < 1.9.1. Fixed in 1.9.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Badge Plugin is a Maven package that allows users to create badges for their Jenkins projects. It provides a way to visually represent project status or other information. The plugin is widely used in Jenkins installations and is an integral part of many CI/CD workflows.
Vulnerability Detail
The Jenkins Badge Plugin version 1.9 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. This vulnerability occurs because the plugin does not properly escape the description and does not check for allowed protocols when creating a badge. Attackers with Item/Configure permission can exploit this vulnerability to inject malicious scripts into the badge description, which will be executed when the badge is viewed by other users. This can lead to unauthorized access, data theft, or further attacks on the Jenkins server.
How To Fix
Latest published version: 3.615.vb_ed967ca_b_e93 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating the Jenkins Badge Plugin to the latest version.
Conclusion
The Jenkins Badge Plugin version 1.9 and earlier is vulnerable to a stored XSS attack. It is crucial for users to update to version 1.9.1 or later to mitigate the risk of unauthorized access and data theft. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:badge →
FAQ
This vulnerability allows attackers to inject malicious scripts into badge descriptions, which can be executed when viewed by other users. It can lead to unauthorized access, data theft, or further attacks on the Jenkins server.
Users of Jenkins Badge Plugin versions 1.9 and earlier are affected by this vulnerability. It is recommended for all users of the plugin to update to version 1.9.1 or later.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to apply the recommended fix to prevent potential attacks.
No, this vulnerability requires attackers to have Item/Configure permission on the Jenkins server. It cannot be exploited remotely without authenticated access.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:badge.
