What is the CVSS score of CVE-2026-42524?

CVE-2026-42524 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Jenkins Html Publisher Plugin are affected by CVE-2026-42524?

Jenkins HTML Publisher Plugin versions 427 and earlier contain a stored cross-site scripting vulnerability that allows authenticated users with job configuration permissions to inject malicious…. A patch is available.

How to fix or mitigate CVE-2026-42524?

Within 24 hours: Identify all Jenkins instances running HTML Publisher Plugin version 427 or earlier and document their locations and versions; alert Jenkins administrators and begin testing the patch in a staging environment. Within 7 days: Apply the available vendor patch to upgrade HTML Publisher Plugin to the latest patched version across all production and non-production Jenkins instances, coordinating deployment during maintenance windows to minimize pipeline disruption. Within 30 days: Audit published report archives for injected malicious content or suspicious JavaScript, review Jenkins access logs from the previous 90 days for unauthorized Item/Configure permission usage, and verify Content Security Policy (CSP) headers are configured on the Jenkins web server to provide defense-in-depth against similar XSS attacks.

Jenkins Html Publisher Plugin CVE-2026-42524

EUVD-2026-26226 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-04-29 jenkins

GHSA-f8h4-46xv-h7jj

XSS Jenkins Jenkins Html Publisher Plugin

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:53 vuln.today

CVSS changed

Apr 29, 2026 - 15:22 NVD

8.0 (None) 8.0 (HIGH)

EUVD ID Assigned

Apr 29, 2026 - 14:00 euvd

EUVD-2026-26226

CVE Published

Apr 29, 2026 - 13:31 nvd

HIGH 8.0

DescriptionCVE.org

Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

AnalysisAI

Stored cross-site scripting in Jenkins HTML Publisher Plugin (versions 427 and earlier) lets an attacker with Item/Configure permission inject JavaScript via an unescaped job name and URL written into the legacy wrapper file, which then executes in the browser of any user who later views the published report. There is no public exploit identified at time of analysis and EPSS is very low (0.04%, 12th percentile), but the SSVC technical impact is rated total, meaning a successful payload can fully compromise a victim session such as an administrator's.