CVE-2022-34176: Cross-site Scripting in Jenkins JUnit Plugin
Summary
CVE-2022-34176: Cross-site Scripting in Jenkins JUnit Plugin. Affects org.jenkins-ci.plugins:junit versions < 1119.1121.vc43d0fc45561. Fixed in 1119.1121.vc43d0fc45561. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins JUnit Plugin is a Maven ecosystem package that provides support for recording and reporting JUnit test results in Jenkins. It allows users to view detailed information about test results, including descriptions. The plugin is widely used in software development and continuous integration processes.
Vulnerability Detail
The JUnit Plugin version 1119.va_a_5e9068da_d7 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. The plugin fails to properly escape descriptions of test results, allowing attackers with Run/Update permission to inject malicious scripts. This vulnerability can be exploited to execute arbitrary code in the context of the affected user, potentially leading to unauthorized access, data theft, or other malicious activities. The issue was fixed in version 1119.1121.vc43d0fc45561, which applies the configured markup formatter to descriptions of test results, preventing XSS attacks.
How To Fix
Latest published version: 1442.vb_b_a_467df2767 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1119.1121.vc43d0fc45561
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the display of test result descriptions in the Jenkins configuration. This can be done by modifying the Jenkins job configuration or the global Jenkins configuration to remove the 'Description' column from the test result view.
Conclusion
The Jenkins JUnit Plugin version 1119.va_a_5e9068da_d7 and earlier is vulnerable to a stored XSS attack. Users should upgrade to version 1119.1121.vc43d0fc45561 or later to fix this issue. As a temporary workaround, the display of test result descriptions can be disabled. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:junit →
FAQ
This vulnerability allows attackers with Run/Update permission to execute arbitrary code in the context of the affected user. It can lead to unauthorized access, data theft, or other malicious activities.
No, only versions 1119.va_a_5e9068da_d7 and earlier are affected. The issue was fixed in version 1119.1121.vc43d0fc45561.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Simply provide your pom.xml file and Vulert will analyze it in real-time.
There is no known public exploit for this vulnerability at the time of this report. However, it is recommended to apply the fix as soon as possible to mitigate the risk.
You can find more information about the fix in the Jenkins JUnit Plugin release notes or the official Jenkins documentation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:junit.
