Headline
GHSA-qrh5-jg98-cr48: Jenkins has a log message injection vulnerability
In Jenkins 2.527 and earlier, LTS 2.516.2 and earlier, the log formatter that prepares log messages for console output (including jenkins.log and equivalent) does not restrict or transform the characters that can be inserted from user-specified content in log messages.
This allows attackers able to control log message contents to insert line break characters, followed by forged log messages that may mislead administrators reviewing log output.
Jenkins 2.528, LTS 2.516.3 adds an indicator at the beginning of a line that was inserted as part of log message content: [CR], [LF], or [CRLF] (representing the kind of line break), followed by > .
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2025-59476
Jenkins has a log message injection vulnerability
Moderate severity GitHub Reviewed Published Sep 17, 2025 to the GitHub Advisory Database • Updated Sep 17, 2025
Package
maven org.jenkins-ci.main:jenkins-core (Maven)
Affected versions
< 2.516.3
>= 2.517, < 2.528
Patched versions
2.516.3
2.528
In Jenkins 2.527 and earlier, LTS 2.516.2 and earlier, the log formatter that prepares log messages for console output (including jenkins.log and equivalent) does not restrict or transform the characters that can be inserted from user-specified content in log messages.
This allows attackers able to control log message contents to insert line break characters, followed by forged log messages that may mislead administrators reviewing log output.
Jenkins 2.528, LTS 2.516.3 adds an indicator at the beginning of a line that was inserted as part of log message content: [CR], [LF], or [CRLF] (representing the kind of line break), followed by > .
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-59476
- https://www.jenkins.io/security/advisory/2025-09-17/#SECURITY-3424
Published to the GitHub Advisory Database
Sep 17, 2025
Last updated
Sep 17, 2025