CVE-2026-42523

{
  "id": "CVE-2026-42523",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-29T14:16:19.360",
  "lastModified": "2026-10-26T20:10:00.160",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the feature \"GitHub hook trigger for GITScm polling\", resulting in a stored cross-site scripting (XSS) vulnerability exploitable by non-anonymous attackers with Overall/Read permission."
    },
    {
      "lang": "es",
      "value": "El Plugin de GitHub de Jenkins 1.46.0 y anteriores procesa incorrectamente la URL del trabajo actual como parte de JavaScript que implementa la validación de la característica ’activador de webhook de GitHub para sondeo de GITScm’, lo que resulta en una vulnerabilidad de cross-site scripting (XSS) almacenado explotable por atacantes no anónimos con permiso General/Lectura."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Jenkins Project",
          "product": "Jenkins GitHub Plugin",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.46.0",
              "versionType": "maven",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "baseScore": 9.0,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-29T14:29:18.837762Z",
          "id": "CVE-2026-42523",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:jenkins:github:*:*:*:*:*:jenkins:*:*",
              "versionEndExcluding": "1.46.0.1",
              "matchCriteriaId": "162727B7-EF1E-4E69-A191-1F9DDE585A37"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.jenkins.io/security/advisory/2026-04-29/#SECURITY-3704",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}