PT-2026-35917 · Jenkins · Jenkins Git Plugin
Published
2026-04-29
·
Updated
2026-04-29
·
CVE-2026-42523
CVSS v3.1
9.0
Critical
| AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook trigger for GITScm polling", resulting in a stored cross-site scripting (XSS) vulnerability exploitable by non-anonymous attackers with Overall/Read permission.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jenkins Git Plugin