CVE-2025-67641: 
Java vulnerability analysis and mitigation

CVE-2025-67641 is a stored cross-site scripting (XSS) vulnerability in the Jenkins Coverage Plugin (SECURITY-3611) that allows authenticated attackers with Item/Configure permission to inject malicious javascript: scheme URLs as coverage result identifiers via the REST API. The vulnerability affects Coverage Plugin versions 2.3054.ve1ff7b_a_a_123b_ and earlier. It was disclosed on December 10, 2025, as part of the Jenkins Security Advisory 2025-12-10. The CVSS v3.1 base score is 5.4 (Medium) per the Jenkins/NVD scoring, though GitHub Advisory rates it 8.0 (High) using a different scope assumption (Jenkins Advisory, GitHub Advisory).

The root cause (CWE-79) is improper neutralization of user-controllable input during web page generation. The Coverage Plugin validates the coverage results ID only when job configuration is submitted through the Jenkins UI, but omits this validation when the job is configured via the REST API. This allows an attacker to set a javascript: scheme URL as the coverage results identifier, which is then stored and rendered as a link in the Jenkins UI. When another user (e.g., an administrator) clicks the malicious link, the JavaScript executes in their browser context. The vulnerability is not exploitable on Jenkins 2.539 or newer when Content Security Policy (CSP) protection is enforced (Jenkins Advisory, GitHub Advisory).

Successful exploitation enables an attacker to execute arbitrary JavaScript in the browser of any Jenkins user who interacts with the malicious coverage result link, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim. The confidentiality and integrity of affected user sessions are at risk, and in environments where administrators are targeted, the impact could extend to full Jenkins instance compromise. Availability is not directly impacted by this vulnerability (Jenkins Advisory, GitHub Advisory).

1. Obtain Item/Configure permission: The attacker must have an authenticated Jenkins account with Item/Configure permission on a target job that uses the Coverage Plugin.
2. Identify the target job: Locate a Jenkins job configured to use the Coverage Plugin for reporting coverage results.
3. Craft a malicious REST API request: Using the Jenkins REST API (e.g., via curl or a scripted HTTP client), submit a job configuration update that sets the coverage results ID to a javascript: scheme URL, such as javascript:alert(document.cookie), bypassing the UI-only validation.

   curl -X POST 'https://<jenkins-host>/job/<job-name>/config.xml' \
     --user '<user>:<api-token>' \
     --header 'Content-Type: application/xml' \
     --data '<project>...<coverageResultId>javascript:alert(document.cookie)</coverageResultId>...</project>'

4. Trigger build and wait for victim: Run the job so that coverage results are generated and stored with the malicious identifier.
5. Victim interaction: When another Jenkins user (e.g., an administrator) navigates to the coverage results page and clicks the malicious link, the javascript: payload executes in their browser, enabling session token theft or other malicious actions (Jenkins Advisory).

• Network: Unexpected REST API calls to Jenkins job configuration endpoints (e.g., POST /job/<name>/config.xml) from accounts that typically use the UI; outbound connections from victim browsers to attacker-controlled infrastructure following interaction with coverage result links.
• Logs: Jenkins access logs showing REST API-based job configuration updates (POST /job/.*/config.xml) by low-privileged users, especially outside normal working hours; entries referencing javascript: strings in job configuration payloads.
• File System: Jenkins job config.xml files containing javascript: scheme strings in coverage results ID fields (e.g., <coverageResultId>javascript:...</coverageResultId>).
• Application: Presence of coverage result entries with javascript: identifiers in the Jenkins UI or stored coverage result data files on the controller (Jenkins Advisory).

Update the Jenkins Coverage Plugin to version 2.3056.v1dfe888b_0249 or later, which validates coverage results IDs at creation time (not just via the UI) and refuses to load existing results with invalid identifiers. As a secondary mitigation, ensure Jenkins core is updated to version 2.539 or newer, where Content Security Policy (CSP) enforcement prevents exploitation of this specific vector. Restrict Item/Configure permissions to trusted users only as a defense-in-depth measure (Jenkins Advisory, GitHub Advisory).

The vulnerability was reported by Kevin Guerroudj of CloudBees, Inc. and disclosed as part of the Jenkins December 2025 security advisory. Security Online Info covered the advisory, noting the XSS risk alongside other Jenkins flaws disclosed simultaneously. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified (Jenkins Advisory).