Open-source package vulnerability · Maven

CVE-2026-42523: Jenkins GitHub Plugin has an XSS vulnerability

criticalCVSS 3.1 9.0GHSA-w22p-4x9f-486v

In Jenkins GitHub Plugin versions 1.46.0 and earlier, the JavaScript that validates the "GitHub hook trigger for GITScm polling" feature improperly processes the current job URL. This results in a stored cross-site scripting (XSS) vulnerability exploitable by non-anonymous attackers with Overall/Read permission.

Published Apr 29, 2026 · Updated Aug 14, 2026

Affected packages

com.coravy.hudson.plugins.github:github

Ecosystem: Maven
Affected: < 1.46.0.1
Fixed in: 1.46.0.1
Check: mvn dependency:tree -Dincludes=com.coravy.hudson.plugins.github:github

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

In Jenkins GitHub Plugin versions 1.46.0 and earlier, the JavaScript that validates the "GitHub hook trigger for GITScm polling" feature improperly processes the current job URL.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by non-anonymous attackers with Overall/Read permission.

GitHub Plugin 1.46.0.1 no longer processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook trigger for GITScm polling".

Credited to sealbenb.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology