CVE-2026-42523: Jenkins GitHub Plugin XSS Vulnerability

CVE-2026-42523 Overview

CVE-2026-42523 is a stored cross-site scripting (XSS) vulnerability affecting Jenkins GitHub Plugin version 1.46.0 and earlier. The vulnerability stems from improper processing of the current job URL as part of JavaScript implementing validation of the "GitHub hook trigger for GITScm polling" feature. This flaw allows non-anonymous attackers with Overall/Read permission to inject malicious scripts that persist and execute in the browsers of other users accessing the affected Jenkins instance.

Critical Impact

Authenticated attackers can exploit this stored XSS vulnerability to steal session credentials, hijack administrator accounts, modify CI/CD pipeline configurations, or inject malicious code into build artifacts affecting downstream software supply chains.

Affected Products

• Jenkins GitHub Plugin 1.46.0 and earlier
• Jenkins instances with GitHub Plugin integration enabled
• CI/CD environments utilizing GitHub webhook triggers for SCM polling

Discovery Timeline

• April 29, 2026 - CVE-2026-42523 published to NVD
• April 29, 2026 - Last updated in NVD database

Technical Details for CVE-2026-42523

Vulnerability Analysis

This stored cross-site scripting vulnerability exists within the JavaScript validation logic for the "GitHub hook trigger for GITScm polling" feature in Jenkins GitHub Plugin. The plugin fails to properly sanitize or encode the current job URL before incorporating it into dynamically generated JavaScript content. When an attacker with Overall/Read permission crafts a malicious job URL containing JavaScript payloads, the unsanitized content is stored and subsequently rendered in the browsers of other authenticated users who access the affected Jenkins pages.

The stored nature of this XSS vulnerability makes it particularly dangerous, as the malicious payload persists on the server and executes automatically whenever legitimate users view the compromised content. This differs from reflected XSS, where user interaction with a malicious link is required for each exploitation attempt.

Root Cause

The root cause is improper input validation and output encoding (CWE-79) in the Jenkins GitHub Plugin. The JavaScript validation code for GitHub hook triggers directly incorporates the job URL into the DOM without proper sanitization, allowing arbitrary script injection. The plugin fails to implement proper context-aware output encoding, which would prevent malicious scripts from being interpreted as executable code by browsers.

Attack Vector

The attack leverages network-accessible Jenkins instances where an authenticated user with Overall/Read permission can manipulate job URL parameters. The attacker crafts a job configuration containing malicious JavaScript within URL fields that are processed by the GitHub hook trigger validation feature. When other users, including administrators, view pages that render this job information, the stored XSS payload executes in their browser context. This can enable session hijacking, CSRF token theft, administrative action impersonation, or modification of build configurations.

The vulnerability requires low privileges (Overall/Read permission) and some user interaction (victim must view the affected page), but the changed scope means successful exploitation can impact resources beyond the vulnerable component's security context.

Detection Methods for CVE-2026-42523

Indicators of Compromise

• Unusual or encoded JavaScript patterns appearing in Jenkins job URLs or configuration fields
• Jenkins audit logs showing unexpected job configuration changes by users with only Overall/Read permission
• Browser console errors or unexpected script executions when accessing Jenkins job pages
• Reports of unexpected session behavior or unauthorized administrative actions following Jenkins page access

Detection Strategies

• Implement Content Security Policy (CSP) headers on Jenkins instances to detect and block inline script execution attempts
• Monitor Jenkins access logs for requests containing encoded script tags or JavaScript event handlers in URL parameters
• Review job configurations for suspicious URL patterns containing <script>, javascript:, or HTML event handlers like onerror and onclick
• Deploy web application firewall (WAF) rules to flag XSS payload patterns in requests to Jenkins endpoints

Monitoring Recommendations

• Enable verbose logging for Jenkins GitHub Plugin operations and monitor for configuration changes
• Configure SentinelOne Singularity Platform to monitor browser processes spawned from Jenkins interactions for anomalous behavior
• Establish baseline metrics for Jenkins administrative actions and alert on deviations indicating potential account compromise
• Implement real-time monitoring of Jenkins job configuration changes with alerts for modifications by users with limited privileges

How to Mitigate CVE-2026-42523

Immediate Actions Required

• Upgrade Jenkins GitHub Plugin to version 1.46.1 or later which contains the security fix for this vulnerability
• Review Jenkins user permissions and restrict Overall/Read access to only essential personnel
• Audit existing job configurations for any signs of injected malicious content in URL fields
• Implement Content Security Policy headers on Jenkins to limit the impact of any stored XSS payloads

Patch Information

Jenkins has released a security advisory (SECURITY-3704) addressing this vulnerability. Organizations should immediately update the Jenkins GitHub Plugin through the Jenkins Update Center or by manually downloading the patched version. The fix implements proper output encoding for job URLs rendered within the GitHub hook trigger validation JavaScript, preventing script injection.

Workarounds

• Temporarily disable the "GitHub hook trigger for GITScm polling" feature until the patch can be applied
• Restrict Overall/Read permission to only trusted users and service accounts
• Implement a reverse proxy with XSS filtering rules in front of Jenkins instances
• Enable HttpOnly and Secure flags on all Jenkins session cookies to limit impact of potential session theft

# Configuration example for Jenkins CSP header in jenkins.xml
# Add to Jenkins startup arguments or system properties
java -Dhudson.model.DirectoryBrowserSupport.CSP="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'" -jar jenkins.war

# Alternative: Set via Jenkins Script Console (Manage Jenkins > Script Console)
# System.setProperty("hudson.model.DirectoryBrowserSupport.CSP", "default-src 'self'; script-src 'self'")