Jenkins Git Parameter vulnerabilities

6 CVEs affecting Jenkins Git Parameter, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-57286, published 2026-06-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-29040, published 2022-04-12. Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days. Jenkins Git Parameter Plugin 0.9.15 and earlier does not escape the name and description of Git parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS)…
CVE-2020-2238, published 2020-09-01. Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days. Jenkins Git Parameter Plugin 0.9.12 and earlier does not escape the repository field on the 'Build with Parameters' page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by…
CVE-2020-2113, published 2020-02-12. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the default value shown on the UI, resulting in a stored cross-site scripting vulnerability exploitable by users with Job/Configure…
CVE-2020-2112, published 2020-02-12. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the parameter name shown on the UI, resulting in a stored cross-site scripting vulnerability exploitable by users with Job/Configure…
CVE-2025-53652, published 2025-07-09. High severity, CVSS 8.2. EPSS: 0.7% chance of exploitation in the next 30 days. Jenkins Git Parameter Plugin 439.vb_0e46ca_14534 and earlier does not validate that the Git parameter value submitted to the build matches one of the offered choices, allowing attackers with…
CVE-2026-57286, published 2026-06-24. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows attackers with Item/Read permission to obtain information about the SCM repository used by a job, such…