Jenkins Project Jenkins GitHub Plugin vulnerabilities

Latest Jenkins Project Jenkins GitHub Plugin CVEs

Newest publication first

1. CVE-2026-42523 Jenkins GitHub Plugin has an XSS vulnerability

   Published 2026-04-29

   Critical·CVSS 9.0 EPSS 0.28%

   Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook trigger for GITScm polling", resulting in a stored cross-site scripting (XSS) vulnerability exploitable by non-anonymous att...

2. CVE-2023-46650 Stored XSS vulnerability in Jenkins GitHub Plugin

   Published 2023-10-25

   Medium·CVSS 5.4 EPSS 0.72%

   Jenkins GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

3. CVE-2022-36885 Jenkins GitHub plugin uses weak webhook signature function

   Published 2022-07-27

   Medium·CVSS 5.3 EPSS 0.92%

   Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are equal, allowing attackers to use statistical methods to obtain a valid webhook signature.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.