HIGH7.1

GHSA-2q27-6p2h-q6r3

Jenkins Assembla Plugin has an XXE vulnerability

Details

Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks when parsing responses from the configured Assembla server.

This allows attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery.

As of publication of this advisory, there is no fix.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.jenkins-ci.plugins:assembla

Introduced in: 0

No fixed version published yet for org.jenkins-ci.plugins:assembla (maven). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-57303[ADVISORY]
https://github.com/lucamilanesio/assembla-jenkins-plugin[PACKAGE]
https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3692%20(1)[WEB]