CVE-2026-42523 in GitHub Plugin
Summary
by MITRE • 04/29/2026
Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook trigger for GITScm polling", resulting in a stored cross-site scripting (XSS) vulnerability exploitable by non-anonymous attackers with Overall/Read permission.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/04/2026
The Jenkins GitHub Plugin version 1.46.0 and earlier contains a critical stored cross-site scripting vulnerability that arises from improper handling of the current job URL within JavaScript validation logic. This flaw specifically affects the "GitHub hook trigger for GITScm polling" feature where the plugin fails to properly sanitize user input when constructing JavaScript code that validates webhook configurations. The vulnerability exists because the plugin directly incorporates unsanitized job URL parameters into dynamically generated JavaScript without adequate escaping or encoding mechanisms, creating an attack surface that can be exploited by authenticated users who possess Overall/Read permission.
The technical implementation of this vulnerability stems from the plugin's approach to generating client-side validation code where it constructs JavaScript functions using data derived from the current job configuration. When a user with appropriate permissions accesses the job configuration page, the plugin generates JavaScript that includes the job URL as part of the validation process. If an attacker can manipulate or control elements of this URL through configuration parameters or by leveraging other vulnerabilities, they can inject malicious script code that will execute in the context of other users' browsers when they view the job configuration page. This stored XSS vulnerability allows attackers to execute arbitrary JavaScript in victims' browsers, potentially enabling session hijacking, data exfiltration, or redirection to malicious sites.
The operational impact of this vulnerability extends beyond simple script execution as it can be leveraged for more sophisticated attacks within the Jenkins environment. An attacker with Overall/Read permission can craft malicious configurations that persist in the system and execute against any user who views the affected job pages. This creates a persistent threat vector that remains active until the vulnerability is patched, allowing for long-term reconnaissance and potential privilege escalation. The stored nature of the XSS means that even if an attacker does not immediately exploit the vulnerability, it can be triggered by other users accessing the configuration interface at any time, potentially affecting multiple victims within the organization.
Security mitigations for this vulnerability should focus on implementing proper input sanitization and output encoding mechanisms throughout the plugin's JavaScript generation process. Organizations should immediately upgrade to Jenkins GitHub Plugin versions 1.47.0 or later where this vulnerability has been addressed through proper URL escaping and parameter validation. Additionally, administrators should review existing job configurations to identify any potentially compromised entries and ensure that all users with Overall/Read permission are properly vetted and monitored for suspicious activities. The vulnerability aligns with CWE-79 (Cross-site Scripting) and can be categorized under ATT&CK technique T1059.007 (Command and Scripting Interpreter: JavaScript) as it enables malicious JavaScript execution within the browser context of legitimate users. Organizations should also consider implementing Content Security Policy headers to limit the execution scope of potentially injected scripts and establish monitoring procedures for unusual configuration changes that might indicate exploitation attempts.