CVE-2026-84665

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the `javascript:` scheme, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

  • Published Sep 2, 2026
  • CVSS 8.0 high
  • 0.4% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-84665 at the National Vulnerability Database