CVE-2022-41239 Stored XSS vulnerability in Jenkins DotCi Plugin

Medium 5.4 Published 21 Sep 2022 Updated 28 May 2025

Stored XSS in Jenkins DotCi Plugin allows attackers to execute scripts via GitHub user names in build causes, potentially compromising user sessions.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2022-41239?

CVE-2022-41239 is a medium-severity cross-site scripting vulnerability in Jenkins DotCi Plugin, published on 21 Sep 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Jenkins DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability.

Weakness: CWE-79

Which versions are affected by CVE-2022-41239?

2 open source packages ship an affected version, including com.groupon.jenkins-ci.plugins:DotCi. It affects 1 product.

Package	Affected	Fixed in
`com.groupon.jenkins-ci.plugins:DotCi` Maven	All versions to `2.40.00`	None
`com.groupon.jenkins-ci.plugins:DotCi` Maven	All versions to `2.40.00`	None

Products include Jenkins Dotci.

How do I fix CVE-2022-41239?

No fix has been published for CVE-2022-41239 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-41239 being exploited?

There is no known exploitation of CVE-2022-41239 in the wild and no public exploit code.

Sources

Also known as GHSA-q9g4-9fx4-v533.