CVE-2022-34778: Cross-site Scripting in Jenkins TestNG Results Plugin
Summary
CVE-2022-34778: Cross-site Scripting in Jenkins TestNG Results Plugin. Affects org.jenkins-ci.plugins:testng-plugin versions < 555.va0d5f66521e3. Fixed in 555.va0d5f66521e3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The TestNG Results Plugin is a plugin for Jenkins, an open-source automation server. It provides options in its post-build step configuration to display test results. The plugin allows users to choose whether or not to escape test descriptions and exception messages. However, versions 554.va4a552116332 and earlier of the TestNG Results Plugin do not properly escape the text provided in test results if the options to escape content are unchecked. This can lead to a cross-site scripting (XSS) vulnerability that can be exploited by attackers who can configure jobs or control test results. The vulnerability is rated as HIGH with a CVSS score of 8.0.
Vulnerability Detail
The TestNG Results Plugin in Jenkins versions 554.va4a552116332 and earlier is vulnerable to cross-site scripting (XSS) attacks. When the options to escape test descriptions and exception messages are unchecked, the plugin renders the unescaped text provided in test results. This allows an attacker with the ability to configure jobs or control test results to inject malicious scripts into the rendered HTML. If a user with sufficient privileges views the affected test results, the injected scripts can be executed in their browser, leading to potential data theft, session hijacking, or other malicious activities. The vulnerability can be mitigated by upgrading to TestNG Results Plugin version 555.va0d5f66521e3 or by setting the hudson.plugins.testng.Publisher.allowUnescapedHTML Java system property to true.
How To Fix
Latest published version: 981.v1dc64d227855 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
555.va0d5f66521e3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of the TestNG Results Plugin is not feasible, administrators can set the hudson.plugins.testng.Publisher.allowUnescapedHTML Java system property to true. This will allow the plugin to render the test results without escaping the content. However, enabling this option may expose users to potential XSS attacks if the test descriptions or exception messages contain untrusted or malicious content. It is recommended to carefully review and sanitize the test results before enabling this option.
Conclusion
The TestNG Results Plugin in Jenkins versions 554.va4a552116332 and earlier is vulnerable to cross-site scripting (XSS) attacks. It is important to upgrade to the latest version of the plugin or apply the recommended workaround to mitigate the vulnerability. Regularly updating Jenkins plugins and following secure coding practices are essential to maintain the security of Jenkins installations. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:testng-plugin →
FAQ
The TestNG Results Plugin is a plugin for Jenkins that provides post-build step configuration options to display test results.
Cross-site scripting (XSS) is a type of security vulnerability where an attacker can inject malicious scripts into a web application, which are then executed by the users' browsers.
This vulnerability can be exploited by attackers who have the ability to configure jobs or control test results in Jenkins. They can inject malicious scripts into the test results, which will be rendered without proper escaping, allowing the scripts to be executed in the browsers of users with sufficient privileges.
The potential consequences of this vulnerability include data theft, session hijacking, and other malicious activities. By injecting malicious scripts, an attacker can steal sensitive information, manipulate user sessions, or perform unauthorized actions on behalf of the affected users.
To mitigate this vulnerability, it is recommended to upgrade to TestNG Results Plugin version 555.va0d5f66521e3 or later. Alternatively, administrators can set the hudson.plugins.testng.Publisher.allowUnescapedHTML Java system property to true. Regularly updating Jenkins plugins and following secure coding practices can also help prevent XSS vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:testng-plugin.
