CVE-2026-42523: Jenkins GitHub Plugin XSS Vulnerability in Versions 1.46.0 and Earlier
Summary
CVE-2026-42523: Jenkins GitHub Plugin has an XSS vulnerability. Affects org.jenkins-ci.plugins:git versions < 1.46.0.1. Fixed in 1.46.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins GitHub Plugin is an essential tool that integrates GitHub with Jenkins, allowing for seamless automation of builds and deployments triggered by GitHub events. This plugin facilitates features such as GitHub hook triggers for GITScm polling, enabling developers to automate their workflows efficiently. However, vulnerabilities in this plugin can expose Jenkins instances to security risks, particularly when improperly handling user inputs.
Vulnerability Detail
In Jenkins GitHub Plugin versions 1.46.0 and earlier, there exists a stored cross-site scripting (XSS) vulnerability due to improper processing of the current job URL in the JavaScript that validates the 'GitHub hook trigger for GITScm polling' feature. This vulnerability can be exploited by non-anonymous attackers who possess Overall/Read permissions, potentially leading to unauthorized script execution in the context of the affected user's session. The vulnerability is classified under CWE-79, indicating its nature as an XSS issue, and carries a CVSS score of 9.0, reflecting its critical severity.
How To Fix
Latest published version: 5.11.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.46.0.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, it is advisable to restrict access to the Jenkins instance by limiting Overall/Read permissions to trusted users only, thereby reducing the risk of exploitation until the plugin can be updated.
Conclusion
The Jenkins GitHub Plugin vulnerability (CVE-2026-42523) poses a significant risk due to its XSS nature, allowing potential exploitation by unauthorized users. Immediate action is required to update the plugin to version 1.46.0.1 or later to mitigate this risk. Users should also consider implementing temporary access restrictions as a precaution.
See every vulnerability recorded for org.jenkins-ci.plugins:git →
FAQ
The vulnerability is a stored cross-site scripting (XSS) issue that allows attackers to execute scripts in the context of a user's session.
Non-anonymous users with Overall/Read permissions on Jenkins instances using the affected versions of the GitHub Plugin are at risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
As a workaround, restrict access to the Jenkins instance by limiting permissions to trusted users until you can apply the update.
The CVSS score of this vulnerability is 9.0, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:git.
