Jenkins GitHub Plugin XSS Vulnerability: Critical CVE-2026-42523
EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
- Severity
- HIGH
- Affected component
- com.coravy.hudson.plugins.github:github (maven)
- Affected versions
- < 1.29.2 or >= 0.1, <= 0.1 or >= 0.2, <= 0.2 or >= 0.3, <= 0.3 or >= 0.4, <= 0.4 or >= 0.5, <= 0.5 or >= 0.6, <= 0.6 or >= 0.7, <= 0.7 or >= 0.8, <= 0.8 or >= 0.9, <= 0.9 or >= 1.0, <= 1.0 or >= 1.1, <= 1.1 or >= 1.10, <= 1.10 or >= 1.11, <= 1.11 or >= 1.11.1, <= 1.11.1 or >= 1.11.2, <= 1.11.2 or >= 1.11.3, <= 1.11.3 or >= 1.12.0, <= 1.12.0 or >= 1.12.0-alpha-1, <= 1.12.0-alpha-1 or >= 1.12.1, <= 1.12.1 or >= 1.13.0, <= 1.13.0 or >= 1.13.0-alpha-1, <= 1.13.0-alpha-1 or >= 1.13.0-alpha-2, <= 1.13.0-alpha-2 or >= 1.13.1, <= 1.13.1 or >= 1.13.2, <= 1.13.2 or >= 1.13.3, <= 1.13.3 or >= 1.14.0, <= 1.14.0 or >= 1.14.0-alpha-1, <= 1.14.0-alpha-1 or >= 1.14.0-alpha-2, <= 1.14.0-alpha-2 or >= 1.14.1, <= 1.14.1 or >= 1.14.2, <= 1.14.2 or >= 1.15.0, <= 1.15.0 or >= 1.16.0, <= 1.16.0 or >= 1.17.0, <= 1.17.0 or >= 1.17.1, <= 1.17.1 or >= 1.18.0, <= 1.18.0 or >= 1.18.1, <= 1.18.1 or >= 1.18.2, <= 1.18.2 or >= 1.19.0, <= 1.19.0 or >= 1.19.1, <= 1.19.1 or >= 1.19.2, <= 1.19.2 or >= 1.19.3, <= 1.19.3 or >= 1.2, <= 1.2 or >= 1.20.0, <= 1.20.0 or >= 1.21.0, <= 1.21.0 or >= 1.21.1, <= 1.21.1 or >= 1.22.0, <= 1.22.0 or >= 1.22.1, <= 1.22.1 or >= 1.22.2, <= 1.22.2 or >= 1.22.3, <= 1.22.3 or >= 1.22.4, <= 1.22.4 or >= 1.23.0, <= 1.23.0 or >= 1.23.1, <= 1.23.1 or >= 1.24.0, <= 1.24.0 or >= 1.25.0, <= 1.25.0 or >= 1.25.1, <= 1.25.1 or >= 1.26.0, <= 1.26.0 or >= 1.26.1, <= 1.26.1 or >= 1.26.2, <= 1.26.2 or >= 1.27.0, <= 1.27.0 or >= 1.28.0, <= 1.28.0 or >= 1.28.1, <= 1.28.1 or >= 1.29.0, <= 1.29.0 or >= 1.29.1, <= 1.29.1 or >= 1.3, <= 1.3 or >= 1.4, <= 1.4 or >= 1.5, <= 1.5 or >= 1.6, <= 1.6 or >= 1.7, <= 1.7 or >= 1.8, <= 1.8 or >= 1.9, <= 1.9 or >= 1.9.1, <= 1.9.1 or < 1.29.1 or >= 0.1, <= 0.1 or >= 0.2, <= 0.2 or >= 0.3, <= 0.3 or >= 0.4, <= 0.4 or >= 0.5, <= 0.5 or >= 0.6, <= 0.6 or >= 0.7, <= 0.7 or >= 0.8, <= 0.8 or >= 0.9, <= 0.9 or >= 1.0, <= 1.0 or >= 1.1, <= 1.1 or >= 1.10, <= 1.10 or >= 1.11, <= 1.11 or >= 1.11.1, <= 1.11.1 or >= 1.11.2, <= 1.11.2 or >= 1.11.3, <= 1.11.3 or >= 1.12.0, <= 1.12.0 or >= 1.12.0-alpha-1, <= 1.12.0-alpha-1 or >= 1.12.1, <= 1.12.1 or >= 1.13.0, <= 1.13.0 or >= 1.13.0-alpha-1, <= 1.13.0-alpha-1 or >= 1.13.0-alpha-2, <= 1.13.0-alpha-2 or >= 1.13.1, <= 1.13.1 or >= 1.13.2, <= 1.13.2 or >= 1.13.3, <= 1.13.3 or >= 1.14.0, <= 1.14.0 or >= 1.14.0-alpha-1, <= 1.14.0-alpha-1 or >= 1.14.0-alpha-2, <= 1.14.0-alpha-2 or >= 1.14.1, <= 1.14.1 or >= 1.14.2, <= 1.14.2 or >= 1.15.0, <= 1.15.0 or >= 1.16.0, <= 1.16.0 or >= 1.17.0, <= 1.17.0 or >= 1.17.1, <= 1.17.1 or >= 1.18.0, <= 1.18.0 or >= 1.18.1, <= 1.18.1 or >= 1.18.2, <= 1.18.2 or >= 1.19.0, <= 1.19.0 or >= 1.19.1, <= 1.19.1 or >= 1.19.2, <= 1.19.2 or >= 1.19.3, <= 1.19.3 or >= 1.2, <= 1.2 or >= 1.20.0, <= 1.20.0 or >= 1.21.0, <= 1.21.0 or >= 1.21.1, <= 1.21.1 or >= 1.22.0, <= 1.22.0 or >= 1.22.1, <= 1.22.1 or >= 1.22.2, <= 1.22.2 or >= 1.22.3, <= 1.22.3 or >= 1.22.4, <= 1.22.4 or >= 1.23.0, <= 1.23.0 or >= 1.23.1, <= 1.23.1 or >= 1.24.0, <= 1.24.0 or >= 1.25.0, <= 1.25.0 or >= 1.25.1, <= 1.25.1 or >= 1.26.0, <= 1.26.0 or >= 1.26.1, <= 1.26.1 or >= 1.26.2, <= 1.26.2 or >= 1.27.0, <= 1.27.0 or >= 1.28.0, <= 1.28.0 or >= 1.28.1, <= 1.28.1 or >= 1.29.0, <= 1.29.0 or >= 1.3, <= 1.3 or >= 1.4, <= 1.4 or >= 1.5, <= 1.5 or >= 1.6, <= 1.6 or >= 1.7, <= 1.7 or >= 1.8, <= 1.8 or >= 1.9, <= 1.9 or >= 1.9.1, <= 1.9.1 or < 1.37.3.1 or >= 0.1, <= 0.1 or >= 0.2, <= 0.2 or >= 0.3, <= 0.3 or >= 0.4, <= 0.4 or >= 0.5, <= 0.5 or >= 0.6, <= 0.6 or >= 0.7, <= 0.7 or >= 0.8, <= 0.8 or >= 0.9, <= 0.9 or >= 1.0, <= 1.0 or >= 1.1, <= 1.1 or >= 1.10, <= 1.10 or >= 1.11, <= 1.11 or >= 1.11.1, <= 1.11.1 or >= 1.11.2, <= 1.11.2 or >= 1.11.3, <= 1.11.3 or >= 1.12.0, <= 1.12.0 or >= 1.12.0-alpha-1, <= 1.12.0-alpha-1 or >= 1.12.1, <= 1.12.1 or >= 1.13.0, <= 1.13.0 or >= 1.13.0-alpha-1, <= 1.13.0-alpha-1 or >= 1.13.0-alpha-2, <= 1.13.0-alpha-2 or >= 1.13.1, <= 1.13.1 or >= 1.13.2, <= 1.13.2 or >= 1.13.3, <= 1.13.3 or >= 1.14.0, <= 1.14.0 or >= 1.14.0-alpha-1, <= 1.14.0-alpha-1 or >= 1.14.0-alpha-2, <= 1.14.0-alpha-2 or >= 1.14.1, <= 1.14.1 or >= 1.14.2, <= 1.14.2 or >= 1.15.0, <= 1.15.0 or >= 1.16.0, <= 1.16.0 or >= 1.17.0, <= 1.17.0 or >= 1.17.1, <= 1.17.1 or >= 1.18.0, <= 1.18.0 or >= 1.18.1, <= 1.18.1 or >= 1.18.2, <= 1.18.2 or >= 1.19.0, <= 1.19.0 or >= 1.19.1, <= 1.19.1 or >= 1.19.2, <= 1.19.2 or >= 1.19.3, <= 1.19.3 or >= 1.2, <= 1.2 or >= 1.20.0, <= 1.20.0 or >= 1.21.0, <= 1.21.0 or >= 1.21.1, <= 1.21.1 or >= 1.22.0, <= 1.22.0 or >= 1.22.1, <= 1.22.1 or >= 1.22.2, <= 1.22.2 or >= 1.22.3, <= 1.22.3 or >= 1.22.4, <= 1.22.4 or >= 1.23.0, <= 1.23.0 or >= 1.23.1, <= 1.23.1 or >= 1.24.0, <= 1.24.0 or >= 1.25.0, <= 1.25.0 or >= 1.25.1, <= 1.25.1 or >= 1.26.0, <= 1.26.0 or >= 1.26.1, <= 1.26.1 or >= 1.26.2, <= 1.26.2 or >= 1.27.0, <= 1.27.0 or >= 1.28.0, <= 1.28.0 or >= 1.28.1, <= 1.28.1 or >= 1.29.0, <= 1.29.0 or >= 1.29.1, <= 1.29.1 or >= 1.29.2, <= 1.29.2 or >= 1.29.3, <= 1.29.3 or >= 1.29.4, <= 1.29.4 or >= 1.29.5, <= 1.29.5 or >= 1.3, <= 1.3 or >= 1.30.0, <= 1.30.0 or >= 1.31.0, <= 1.31.0 or >= 1.32.0, <= 1.32.0 or >= 1.33.0, <= 1.33.0 or >= 1.33.1, <= 1.33.1 or >= 1.34.0, <= 1.34.0 or >= 1.34.1, <= 1.34.1 or >= 1.34.1.1, <= 1.34.1.1 or >= 1.34.2, <= 1.34.2 or >= 1.34.3, <= 1.34.3 or >= 1.34.3.1, <= 1.34.3.1 or >= 1.34.4, <= 1.34.4 or >= 1.34.5, <= 1.34.5 or >= 1.35.0, <= 1.35.0 or >= 1.36.0, <= 1.36.0 or >= 1.36.1, <= 1.36.1 or >= 1.37.0, <= 1.37.0 or >= 1.37.1, <= 1.37.1 or >= 1.37.2, <= 1.37.2 or >= 1.37.3, <= 1.37.3 or >= 1.4, <= 1.4 or >= 1.5, <= 1.5 or >= 1.6, <= 1.6 or >= 1.7, <= 1.7 or >= 1.8, <= 1.8 or >= 1.9, <= 1.9 or >= 1.9.1, <= 1.9.1 or < 1.34.5 or >= 0.1, <= 0.1 or >= 0.2, <= 0.2 or >= 0.3, <= 0.3 or >= 0.4, <= 0.4 or >= 0.5, <= 0.5 or >= 0.6, <= 0.6 or >= 0.7, <= 0.7 or >= 0.8, <= 0.8 or >= 0.9, <= 0.9 or >= 1.0, <= 1.0 or >= 1.1, <= 1.1 or >= 1.10, <= 1.10 or >= 1.11, <= 1.11 or >= 1.11.1, <= 1.11.1 or >= 1.11.2, <= 1.11.2 or >= 1.11.3, <= 1.11.3 or >= 1.12.0, <= 1.12.0 or >= 1.12.0-alpha-1, <= 1.12.0-alpha-1 or >= 1.12.1, <= 1.12.1 or >= 1.13.0, <= 1.13.0 or >= 1.13.0-alpha-1, <= 1.13.0-alpha-1 or >= 1.13.0-alpha-2, <= 1.13.0-alpha-2 or >= 1.13.1, <= 1.13.1 or >= 1.13.2, <= 1.13.2 or >= 1.13.3, <= 1.13.3 or >= 1.14.0, <= 1.14.0 or >= 1.14.0-alpha-1, <= 1.14.0-alpha-1 or >= 1.14.0-alpha-2, <= 1.14.0-alpha-2 or >= 1.14.1, <= 1.14.1 or >= 1.14.2, <= 1.14.2 or >= 1.15.0, <= 1.15.0 or >= 1.16.0, <= 1.16.0 or >= 1.17.0, <= 1.17.0 or >= 1.17.1, <= 1.17.1 or >= 1.18.0, <= 1.18.0 or >= 1.18.1, <= 1.18.1 or >= 1.18.2, <= 1.18.2 or >= 1.19.0, <= 1.19.0 or >= 1.19.1, <= 1.19.1 or >= 1.19.2, <= 1.19.2 or >= 1.19.3, <= 1.19.3 or >= 1.2, <= 1.2 or >= 1.20.0, <= 1.20.0 or >= 1.21.0, <= 1.21.0 or >= 1.21.1, <= 1.21.1 or >= 1.22.0, <= 1.22.0 or >= 1.22.1, <= 1.22.1 or >= 1.22.2, <= 1.22.2 or >= 1.22.3, <= 1.22.3 or >= 1.22.4, <= 1.22.4 or >= 1.23.0, <= 1.23.0 or >= 1.23.1, <= 1.23.1 or >= 1.24.0, <= 1.24.0 or >= 1.25.0, <= 1.25.0 or >= 1.25.1, <= 1.25.1 or >= 1.26.0, <= 1.26.0 or >= 1.26.1, <= 1.26.1 or >= 1.26.2, <= 1.26.2 or >= 1.27.0, <= 1.27.0 or >= 1.28.0, <= 1.28.0 or >= 1.28.1, <= 1.28.1 or >= 1.29.0, <= 1.29.0 or >= 1.29.1, <= 1.29.1 or >= 1.29.2, <= 1.29.2 or >= 1.29.3, <= 1.29.3 or >= 1.29.4, <= 1.29.4 or >= 1.29.5, <= 1.29.5 or >= 1.3, <= 1.3 or >= 1.30.0, <= 1.30.0 or >= 1.31.0, <= 1.31.0 or >= 1.32.0, <= 1.32.0 or >= 1.33.0, <= 1.33.0 or >= 1.33.1, <= 1.33.1 or >= 1.34.0, <= 1.34.0 or >= 1.34.1, <= 1.34.1 or >= 1.34.1.1, <= 1.34.1.1 or >= 1.34.2, <= 1.34.2 or >= 1.34.3, <= 1.34.3 or >= 1.34.3.1, <= 1.34.3.1 or >= 1.34.4, <= 1.34.4 or >= 1.4, <= 1.4 or >= 1.5, <= 1.5 or >= 1.6, <= 1.6 or >= 1.7, <= 1.7 or >= 1.8, <= 1.8 or >= 1.9, <= 1.9 or >= 1.9.1, <= 1.9.1 or < 1.29.1 or >= 0.1, <= 0.1 or >= 0.2, <= 0.2 or >= 0.3, <= 0.3 or >= 0.4, <= 0.4 or >= 0.5, <= 0.5 or >= 0.6, <= 0.6 or >= 0.7, <= 0.7 or >= 0.8, <= 0.8 or >= 0.9, <= 0.9 or >= 1.0, <= 1.0 or >= 1.1, <= 1.1 or >= 1.10, <= 1.10 or >= 1.11, <= 1.11 or >= 1.11.1, <= 1.11.1 or >= 1.11.2, <= 1.11.2 or >= 1.11.3, <= 1.11.3 or >= 1.12.0, <= 1.12.0 or >= 1.12.0-alpha-1, <= 1.12.0-alpha-1 or >= 1.12.1, <= 1.12.1 or >= 1.13.0, <= 1.13.0 or >= 1.13.0-alpha-1, <= 1.13.0-alpha-1 or >= 1.13.0-alpha-2, <= 1.13.0-alpha-2 or >= 1.13.1, <= 1.13.1 or >= 1.13.2, <= 1.13.2 or >= 1.13.3, <= 1.13.3 or >= 1.14.0, <= 1.14.0 or >= 1.14.0-alpha-1, <= 1.14.0-alpha-1 or >= 1.14.0-alpha-2, <= 1.14.0-alpha-2 or >= 1.14.1, <= 1.14.1 or >= 1.14.2, <= 1.14.2 or >= 1.15.0, <= 1.15.0 or >= 1.16.0, <= 1.16.0 or >= 1.17.0, <= 1.17.0 or >= 1.17.1, <= 1.17.1 or >= 1.18.0, <= 1.18.0 or >= 1.18.1, <= 1.18.1 or >= 1.18.2, <= 1.18.2 or >= 1.19.0, <= 1.19.0 or >= 1.19.1, <= 1.19.1 or >= 1.19.2, <= 1.19.2 or >= 1.19.3, <= 1.19.3 or >= 1.2, <= 1.2 or >= 1.20.0, <= 1.20.0 or >= 1.21.0, <= 1.21.0 or >= 1.21.1, <= 1.21.1 or >= 1.22.0, <= 1.22.0 or >= 1.22.1, <= 1.22.1 or >= 1.22.2, <= 1.22.2 or >= 1.22.3, <= 1.22.3 or >= 1.22.4, <= 1.22.4 or >= 1.23.0, <= 1.23.0 or >= 1.23.1, <= 1.23.1 or >= 1.24.0, <= 1.24.0 or >= 1.25.0, <= 1.25.0 or >= 1.25.1, <= 1.25.1 or >= 1.26.0, <= 1.26.0 or >= 1.26.1, <= 1.26.1 or >= 1.26.2, <= 1.26.2 or >= 1.27.0, <= 1.27.0 or >= 1.28.0, <= 1.28.0 or >= 1.28.1, <= 1.28.1 or >= 1.29.0, <= 1.29.0 or >= 1.3, <= 1.3 or >= 1.4, <= 1.4 or >= 1.5, <= 1.5 or >= 1.6, <= 1.6 or >= 1.7, <= 1.7 or >= 1.8, <= 1.8 or >= 1.9, <= 1.9 or >= 1.9.1, <= 1.9.1
- Patched version
- 1.46.0.1
GHSA-W22P-4X9F-486V
An early warning has been issued for a stored cross-site scripting (XSS) vulnerability in Jenkins GitHub Plugin versions 1.46.0 and earlier. Non-anonymous attackers with Overall/Read permission can exploit this vulnerability.
What happened
The Jenkins GitHub Plugin has a stored cross-site scripting (XSS) vulnerability in versions 1.46.0 and earlier. This vulnerability allows non-anonymous attackers with Overall/Read permission to execute malicious scripts in the context of other users. The vulnerability was first flagged on April 29, 2026, and is currently under investigation. It has not been exploited in the wild as of the latest reports.
To assess your exposure, check if you are using any version of the Jenkins GitHub Plugin that is less than 1.46.0.1. If so, you are potentially vulnerable to this XSS attack. It is recommended to upgrade to version 1.46.0.1 or later to mitigate the risk.
What to do about it
- Identify and list all instances of the Jenkins GitHub Plugin in your environment.
- Check the version of the Jenkins GitHub Plugin in each instance.
- Upgrade any instances of the Jenkins GitHub Plugin that are version 1.46.0 or earlier to version 1.46.0.1 or later.
- Monitor the primary sources for updates on this vulnerability and any additional mitigation steps that may be recommended.
How 0Day would have caught this
MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If
com.coravy.hudson.plugins.github:github is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using any version of the Jenkins GitHub Plugin that is less than 1.46.0.1.
What should I do right now?
Upgrade any instances of the Jenkins GitHub Plugin that are version 1.46.0 or earlier to version 1.46.0.1 or later.
Has this been exploited in the wild?
No, this vulnerability has not been exploited in the wild as of the latest reports.