The Jenkins Coverage Plugin is vulnerable to stored cross-site scripting, which could allow authenticated attackers with configuration permissions to execute arbitrary scripts in the context of other users.

The plugin fails to validate the coverage results ID when configured via the REST API, allowing an attacker with Item/Configure permission to inject a javascript: scheme URL, leading to stored XSS.

The vulnerability carries a CVSS score of 8.0, reflecting a high potential for impact on confidentiality, integrity, and availability within the Jenkins environment. Successful exploitation allows an attacker to execute scripts in the browser of a victim, which could lead to unauthorized actions, session hijacking, or the modification of build configurations, ultimately compromising the software supply chain.

Immediate Action: Update the Jenkins Coverage Plugin to the version specified in the vendor security advisory at https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3611.

Proactive Monitoring: Review Jenkins access logs for suspicious REST API configuration requests, particularly those involving unexpected URL schemes or script-like content in the coverage results ID field.

Compensating Controls: Restrict access to the Jenkins REST API and limit the number of users granted Item/Configure permissions to those strictly requiring them for administrative tasks.

Public Exploit Available: Unknown

Given the potential for high-impact stored XSS within a continuous integration environment, administrators should prioritize updating the Jenkins Coverage Plugin immediately. Restricting configuration permissions to a minimal set of trusted users is a necessary secondary measure to ensure the security of the build pipeline and prevent unauthorized script injection.