Paper/Archive/CVE-2026-42523

CVE-2026-42523

Jenkins Project Jenkins GitHub Plugin — Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the fe…

EPSS 0.3%CVSS 9.0

critical.is priorityof 100

CVSS 9.0 (ADP)9.0 / 10 × 3027.0 Not in CISA KEV+300.0 EPSS percentile 20.6.206 × 204.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook trigger for GITScm polling", resulting in a stored cross-site scripting (XSS) vulnerability exploitable by non-anonymous attackers with Overall/Read permission.

Affected

ProductAffectedFixed inSource

Jenkins GitHub Plugin≤ 1.46.0–CNA

Scores by source

CISA ADP9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisoryjenkins.io/security/advisory/2026-04-29/#SECURITY-3704