CVE-2023-25761: Jenkins Junit

Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days.

Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit resources processed by the plugin.

Affected products

• Jenkins Junit: up to and including 1166.va_436e268e972

Published 2023-02-15. Last modified 2026-06-17.