CVE-2021-21677: Jenkins Code Coverage API

High severity, CVSS 8.8. EPSS: 2.2% chance of exploitation in the next 30 days.

Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply Jenkins JEP-200 deserialization protection to Java objects it deserializes from disk, resulting in a remote code execution vulnerability.

Affected products

• Jenkins Code Coverage API: up to and including 1.4.0

Published 2021-08-31. Last modified 2026-06-17.