Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job configuration pages, resulting in a stored XSS vulnerability exploitable by users able to define node labels.
References:- https://nvd.nist.gov/vuln/detail/CVE-2020-2161
- https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1781
- http://www.openwall.com/lists/oss-security/2020/03/25/2
- https://github.com/jenkinsci/jenkins/commit/dbff6fdcf8c4bc00729ace66c33208ae7aa18ac0
- https://github.com/advisories/GHSA-g8pg-qrvm-wgh2