CVE-2025-47885: Jenkins Health Advisor by CloudBees Plugin Vulnerable to Cross-Site Scripting
Summary
CVE-2025-47885: Jenkins Health Advisor by CloudBees Plugin Vulnerable to Cross-Site Scripting. Affects org.jenkins-ci.plugins:cloudbees-jenkins-advisor versions < 374.376.v3a_41a_a_142efe. Fixed in 374.376.v3a_41a_a_142efe. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Health Advisor by CloudBees Plugin is an essential tool for Jenkins users, providing insights and recommendations to enhance the health and performance of Jenkins instances. It integrates with the Jenkins server to offer real-time health assessments. However, this plugin has a critical vulnerability that allows attackers to exploit stored cross-site scripting (XSS) due to improper handling of server responses.
Vulnerability Detail
The vulnerability arises from the Jenkins Health Advisor by CloudBees Plugin versions 374.v194b_d4f0c8c8 and earlier, which fail to escape responses from the Jenkins Health Advisor server. This oversight allows attackers who can control the server responses to inject malicious scripts, leading to stored XSS vulnerabilities. The ramifications include unauthorized access to sensitive information, session hijacking, and potential defacement of the Jenkins interface.
How To Fix
Latest published version: 412.v9d1e9d6a_f428 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
374.376.v3a_41a_a_142efe
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Jenkins Health Advisor server responses or disable the plugin until the update is applied. However, this may limit the functionality of the health advisor features.
Conclusion
The Jenkins Health Advisor by CloudBees Plugin has a critical stored XSS vulnerability that can be exploited by attackers controlling server responses. Users are strongly advised to update to the patched version to mitigate risks. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for org.jenkins-ci.plugins:cloudbees-jenkins-advisor →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
The potential impacts include unauthorized access to sensitive data, session hijacking, and the ability to execute malicious scripts in the context of the user's session.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By uploading your pom.xml file to the Vulert playground, you can check if your application is affected without any signup.
Yes, you can restrict access to the Jenkins Health Advisor server responses or temporarily disable the plugin until the patch is applied.
You can find more information on the official Jenkins plugin site or the GitHub repository for the Jenkins Health Advisor by CloudBees Plugin.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:cloudbees-jenkins-advisor.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
