Skip to content
CVE PROGRAM SOURCE RECORD9.0 Critical

CVE-2026-42523

Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook trigger for GITScm polli

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
jenkins

Description

Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook trigger for GITScm polling", resulting in a stored cross-site scripting (XSS) vulnerability exploitable by non-anonymous attackers with Overall/Read permission.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Jenkins Project Jenkins GitHub Plugin

Default version status: unaffected

  • 0 to ≤ 1.46.0affected

References