EUVD-2026-26225
GHSA-w22p-4x9f-486v
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Stored cross-site scripting in the Jenkins GitHub Plugin (versions ≤ 1.46.0) lets a low-privileged authenticated user with Overall/Read permission inject JavaScript by controlling the current job URL, which is unsafely embedded into the client-side validation logic for the 'GitHub hook trigger for GITScm polling' feature. When another user — potentially a Jenkins administrator — views the affected page, the attacker's script executes inside their authenticated Jenkins session. No public exploit is identified at time of analysis and EPSS is very low (0.04%), but the CVSS 9.0 rating and scope-changed impact make it a meaningful CI/CD privilege-escalation surface.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Jenkins Github Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (jenkins) · only source for this CVE.
CVSS VectorVendor: jenkins
Lifecycle Timeline
2DescriptionCVE.org
Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook trigger for GITScm polling", resulting in a stored cross-site scripting (XSS) vulnerability exploitable by non-anonymous attackers with Overall/Read permission.
Executive ViewAI
Jenkins GitHub Plugin versions 1.46.0 and earlier contain a stored cross-site scripting vulnerability that allows low-privileged authenticated users to escalate privileges through malicious JavaScript injection, potentially compromising CI/CD pipeline operations and administrative access when administrators view the affected configuration page. While no public exploit is identified at time of analysis and exploitation probability is minimal (0.0% EPSS), the CVSS 9.0 score with scope change represents a meaningful privilege-escalation risk to production deployment infrastructure.
Within 24 hours, inventory all Jenkins instances and identify those running GitHub Plugin version 1.46.0 or earlier. Within 7 days, apply the vendor-released patch to upgrade GitHub Plugin to version 1.46.1 or later across all identified instances and verify successful deployment. Within 30 days, conduct a targeted access review to audit which users hold Overall/Read permission levels and remove unnecessary privileges in accordance with least-privilege policy.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB