CVE-2020-2224: Jenkins Matrix Project

Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days.

Jenkins Matrix Project Plugin 1.16 and earlier does not escape the node names shown in tooltips on the overview page of builds with a single axis, resulting in a stored cross-site scripting vulnerability.

Affected products

• Jenkins Matrix Project: up to and including 1.16

Published 2020-07-15. Last modified 2026-06-17.