Stored XSS in Jenkins GitHub Plugin via job URL processing (CVE-2026-42523)

Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the "GitHub hook trigger for GITScm polling" feature, resulting in a stored cross-site scripting (XSS) vulnerability. Non-anonymous attackers with Overall/Read permission can exploit this vulnerability. Affected versions: - GitHub Plugin 1.46.0 and earlier We recommend updating to: GitHub Plugin 1.46.0.1. CVSS 9.0 · our assessment: act_now Reference: https://www.jenkins.io/security/advisory/2026-04-29/#SECURITY-3704 Details: https://vuln.today/cve/CVE-2026-42523