GitHub Advisoryadvisory · Maven

GHSA-w22p-4x9f-486v Jenkins GitHub Plugin has an XSS vulnerability

CRITICAL Published 2026-04-29 Modified 2026-08-14 Official page ↗
Aliases
CVE-2026-42523
Ecosystem
Maven
Packages
com.coravy.hudson.plugins.github:github
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2026-05-06

Affected packages

• Maven com.coravy.hudson.plugins.github:github: < 1.46.0.1 → fixed in 1.46.0.1

Description

In Jenkins GitHub Plugin versions 1.46.0 and earlier, the JavaScript that validates the "GitHub hook trigger for GITScm polling" feature improperly processes the current job URL. This results in a stored cross-site scripting (XSS) vulnerability exploitable by non-anonymous attackers with Overall/Read permission. GitHub Plugin 1.46.0.1 no longer processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook trigger for GITScm polling".

Related

Alias · CVE (1)

  • CVE-2026-42523 Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References