CVE-2021-21667: Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms,...

Security readout for executives and security teams

Jenkins Scriptler Plugin 3.2 and earlier can store unsafe parameter names that appear in job configuration forms. A user with Scriptler/Configure permission could plant content that runs in another user's browser when viewed. This is most relevant for Jenkins environments where Scriptler is installed and configuration rights are broadly granted. Exposure is limited to Jenkins instances running Scriptler Plugin 3.2 or earlier. Risk increases when non-administrators or broad groups have Scriptler/Configure permission, or when many privileged users view job configuration forms. Treat as a targeted Jenkins hardening item, not an internet-scale emergency based on provided evidence. Prioritize quickly where Jenkins supports production delivery, many users can configure Scriptler, or privileged administrators regularly access affected configuration forms. Mitigation focus: Check Jenkins advisory and plugin guidance for fixed versions or vendor-recommended actions.; Upgrade Scriptler Plugin if vendor guidance identifies a corrected release.; Remove or disable Scriptler Plugin if it is not required..

Prepared

Jun 2, 2026, 19:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.