CVE-2020-2176: Jenkins Usemango Runner

Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days.

Multiple form validation endpoints in Jenkins useMango Runner Plugin 1.4 and earlier do not escape values received from the useMango service, resulting in a cross-site scripting (XSS) vulnerability exploitable by users able to control the values returned from the useMango service.

Affected products

• Jenkins Usemango Runner: up to and including 1.4

Published 2020-04-07. Last modified 2026-06-17.