CVE-2025-30196: Jenkins Anchorchain

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Jenkins AnchorChain Plugin 1.0 does not limit URL schemes for links it creates based on workspace content, allowing the `javascript:` scheme, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control the input file for the Anchor Chain post-build step.

Affected products

• Jenkins Anchorchain: version 1.0 only

Published 2025-03-19. Last modified 2026-06-17.