The Jenkins Gitee Plugin version 1301.v8957053c7902 and earlier fails to escape the sender name field from Gitee push webhook payloads when creating build causes. This flaw results in a stored cross-site scripting (XSS) vulnerability, which can be exploited by attackers who have the ability to trigger builds through the Jenkins Gitee Plugin webhook endpoint. The vulnerability allows injection of malicious scripts that could be executed in the context of the Jenkins web interface.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the Jenkins web interface. This may lead to unauthorized actions within the Jenkins environment, such as stealing user credentials or performing actions on behalf of authenticated users. However, exploitation requires the attacker to be able to trigger builds via the webhook endpoint.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Jenkins Gitee Plugin webhook endpoint to trusted sources only to reduce the risk of exploitation.