PT-2026-35917 · Jenkins · Github Plugin+1

Dqh1 · Published 2026-04-29 · Updated 2026-05-05 · CVE-2026-42523

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins GitHub Plugin versions prior to 1.46.1

Description Improper processing of the current job URL within the JavaScript used to validate the "GitHub hook trigger for GITScm polling" feature allows non-anonymous attackers with Overall/Read permission to execute a stored cross-site scripting (XSS) attack. XSS is a flaw where malicious scripts are injected into trusted websites.

Recommendations Update to a version later than 1.46.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-06411

CVE-2026-42523

GHSA-W22P-4X9F-486V

Affected Products

Github Plugin

Jenkins

References · 6

• https://jenkins.io/security/advisory/2026-04-29/#SECURITY-3704 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06411 · Security Note
• https://osv.dev/vulnerability/GHSA-w22p-4x9f-486v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42523 · Security Note
• https://t.me/cveNotify/162220 · Telegram Post
• https://twitter.com/CVEnew/status/2049594352045785467 · Twitter Post