CVE-2026-42523: Jenkins GitHub Plugin stored XSS in job URL validation

CVE-2026-42523 · Severity: critical · CVSS 9 · Published 2026-04-29

Jenkins GitHub Plugin is a widely-used integration tool that connects Jenkins continuous integration servers with GitHub repositories. A vulnerability in the plugin's webhook validation logic allows authenticated users with basic read permissions to inject malicious JavaScript code that executes in the browsers of other users viewing affected job configurations. This could lead to session hijacking, credential theft, or unauthorized modification of build configurations.

Technologies: com.coravy.hudson.plugins.github:github (Maven). Vendors: Jenkins, Maven.

Quick answers

Is CVE-2026-42523 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42523 being exploited in the wild.
How severe is CVE-2026-42523?
Critical severity, with a CVSS score of 9, published 29 April 2026.
Which products and versions are affected?
com.coravy.hudson.plugins.github:github (Maven) < 1.46.0.1, ECOSYSTEM:introduced=0,fixed=1.46.0.1.
Is there a fix for CVE-2026-42523?
Yes. com.coravy.hudson.plugins.github:github (Maven): upgrade to 1.46.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42523 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-42523?
Check whether you run Jenkins Github or com.coravy.hudson.plugins.github:github (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.coravy.hudson.plugins.github:github (Maven): upgrade to 1.46.0.1 or later
    # set com.coravy.hudson.plugins.github:github to 1.46.0.1 in your pom.xml or build.gradle

Technical details

The vulnerability is a stored cross-site scripting (CWE-79) flaw in the JavaScript code that validates the "GitHub hook trigger for GITScm polling" feature in Jenkins GitHub Plugin versions prior to 1.46.0.1. The vulnerable component improperly sanitizes the current job URL before inserting it into client-side JavaScript, allowing an authenticated attacker with Overall/Read permission to craft a malicious job URL containing JavaScript payloads. When other users access the job configuration page, the injected script executes in their browser context with the attacker's privileges. The vulnerability requires user interaction (victim must view the affected job page) and low-privilege authenticated access. The fix in version 1.46.0.1 removes the problematic job URL processing entirely from the validation JavaScript.

Affected products

  • Jenkins GitHub Plugin < 1.46.0.1

Identifiers

  • CVE-2026-42523
  • GHSA-w22p-4x9f-486v

Timeline

  • 2026-04-29: disclosed: Published by GitHub Advisory Database and NVD
  • 2026-04-29: patched: Version 1.46.0.1 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.