CVE-2025-5806: Jenkins Gatling Plugin Cross-Site Scripting Vulnerability
Summary
CVE-2025-5806: Jenkins Gatling Plugin Vulnerable to Cross-Site Scripting (XSS). Affects org.jenkins-ci.plugins:gatling versions 136.vb. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Gatling Plugin is an extension for Jenkins that allows users to generate and visualize performance testing reports using Gatling. It is widely used in continuous integration and deployment pipelines to assess the performance of applications under load. However, the plugin has a vulnerability that allows for cross-site scripting (XSS) attacks, which can compromise the security of Jenkins instances.
Vulnerability Detail
The Jenkins Gatling Plugin version 136.vb_9009b_3d33a_e is vulnerable to a cross-site scripting (XSS) attack due to improper handling of Gatling reports. This vulnerability arises from the plugin's failure to enforce the Content-Security-Policy protections introduced in Jenkins versions 1.641 and 1.625. As a result, users who can modify report content may inject malicious scripts, leading to potential data theft, session hijacking, or unauthorized actions within the Jenkins environment.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict access to the Gatling reports to trusted users only. This can be done by configuring user permissions in Jenkins to limit who can modify report content.
Conclusion
The Jenkins Gatling Plugin is vulnerable to a cross-site scripting attack that can compromise the security of Jenkins instances. It is crucial to update the plugin to the latest version to mitigate this risk. Additionally, using tools like Vulert can help monitor for vulnerabilities in your open-source dependencies effectively.
See every vulnerability recorded for org.jenkins-ci.plugins:gatling →
FAQ
The CVSS score of this vulnerability is 8.0, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploiting this vulnerability can lead to data theft, session hijacking, and unauthorized actions within the Jenkins environment.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just the pom.xml file of your project.
If you cannot update the plugin immediately, ensure to restrict access to the Gatling reports to trusted users only as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:gatling.
