Jenkins Gatling vulnerabilities

2 CVEs affecting Jenkins Gatling, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-5806, published 2025-06-06.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-2173, published 2020-04-07. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. Jenkins Gatling Plugin 1.2.7 and earlier prevents Content-Security-Policy headers from being set for Gatling reports served by the plugin, resulting in an XSS vulnerability exploitable by users able…
• CVE-2025-5806, published 2025-06-06. High severity, CVSS 8.0. EPSS: 0.5% chance of exploitation in the next 30 days. Jenkins Gatling Plugin 136.vb_9009b_3d33a_e serves Gatling reports in a manner that bypasses the Content-Security-Policy protection introduced in Jenkins 1.641 and 1.625, resulting in a cross-site…