CVE-2022-29044

Deeper analysis

The Jenkins Node and Label Parameter Plugin versions 1.10.3 and earlier contain a stored cross-site scripting vulnerability because the plugin fails to escape the name and description fields of Node and Label parameters when those values are rendered on parameter-display views. The affected component is the Jenkins continuous-integration server when this plugin is installed and configured to expose such parameters.

Attackers who possess Item/Configure permission on a Jenkins job can supply malicious payloads in the parameter name or description fields. When another user subsequently views the job's parameter page, the injected script executes in the victim's browser context, allowing limited theft of session data or actions within the Jenkins instance under the victim's privileges.

The official Jenkins security advisory published on 2022-04-12 recommends upgrading the Node and Label Parameter Plugin to a fixed release that properly escapes the affected fields; administrators are advised to apply the update and review any existing jobs that use the plugin.

The EPSS score for this CVE rose sharply from a low baseline to a peak of 0.2585 in December 2025 before receding, indicating that exploitation interest materialized well after the original disclosure and that the issue merits renewed attention despite its current low probability.