CVE-2026-84665: Vulnerability in Jenkins Project Jenkins SonarQube Scanner Plugin

Jenkins SonarQube Scanner Plugin versions 2.18.3 and earlier fail to limit URL schemes for dashboard links generated from SonarQube scanner results. This allows an attacker with Item/Configure permission to inject a 'javascript:' URL scheme, resulting in a stored cross-site scripting (XSS) vulnerability (CWE-79). The vulnerability enables execution of arbitrary JavaScript code within the Jenkins web interface, potentially compromising confidentiality, integrity, and availability of the Jenkins environment.

Successful exploitation allows an attacker with Item/Configure permission to execute arbitrary JavaScript code in the Jenkins web interface. This can lead to full compromise of the affected Jenkins instance, including unauthorized access to sensitive data, modification of configurations, and disruption of service. The CVSS v3.1 base score is 8.0 (High), reflecting network attack vector, low attack complexity, required privileges, user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Item/Configure permissions to trusted users only to reduce the risk of exploitation. Monitor Jenkins plugin updates and apply official fixes once released.