CVE-2023-28681: Jenkins Visual Studio Code Metrics

High severity, CVSS 8.2. EPSS: 0.6% chance of exploitation in the next 30 days.

Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected products

• Jenkins Visual Studio Code Metrics: up to and including 1.7

Published 2023-04-02. Last modified 2026-06-17.