GHSA-w22p-4x9f-486vCriticalCVSS 9.0

Jenkins GitHub Plugin has an XSS vulnerability

Published
April 29, 2026
Last Modified
August 14, 2026

🔗 CVE IDs covered (1)

CVE-2026-42523 →

📋 Description

In Jenkins GitHub Plugin versions 1.46.0 and earlier, the JavaScript that validates the "GitHub hook trigger for GITScm polling" feature improperly processes the current job URL.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by non-anonymous attackers with Overall/Read permission.

GitHub Plugin 1.46.0.1 no longer processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook trigger for GITScm polling".

🎯 Affected products1

  • maven/com.coravy.hudson.plugins.github:github:< 1.46.0.1

🔗 References (3)