high8.0
CVE-2025-53658
Jenkins Applitools Eyes Plugin vulnerable to XSS through its Build page
Impact
Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not escape the Applitools URL on the build page. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Applitools Eyes Plugin 1.16.6 rejects Applitools URLs that contain HTML metacharacters.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:applitools-eyes | <= 1.16.5 | 1.16.6 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Applitools Eyes | before 1.16.6 |