GHSA-f8h4-46xv-h7jj

Source

https://github.com/advisories/GHSA-f8h4-46xv-h7jj

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-f8h4-46xv-h7jj/GHSA-f8h4-46xv-h7jj.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-f8h4-46xv-h7jj

Aliases

CVE-2026-42524

Published

2026-04-29T15:30:39Z

Modified

2026-05-06T23:11:23Z

Severity

8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Jenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper file

Details

Jenkins HTML Publisher Plugin versoins 427 and earlier do not escape the job name and URL in the legacy wrapper file.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

HTML Publisher Plugin 427.1 escapes job name and URL when generating the legacy wrapper file.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-06T22:52:09Z",
    "nvd_published_at":  "2026-04-29T14:16:19Z",
    "severity":  "HIGH"
}

References

Affected packages

Maven / org.jenkins-ci.plugins:htmlpublisher

Package

Name: org.jenkins-ci.plugins:htmlpublisher; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/htmlpublisher

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

427.1

Affected versions

0.*

0.7

0.8

1.*

1.0

1.1

1.2

1.3

1.4

1.5

1.6

1.7

1.8

1.9

1.10

1.11

1.12

1.13

1.14

1.15

1.16

1.16.1

1.17

1.18

1.19

1.20

1.21

1.22-beta-1

1.22

1.23

1.24

1.25

1.26

1.27

1.28

1.29

1.30

1.31

1.32

1.32.1

1.33

1.34

1.35

1.36

1.37

424.*

424.va_e57f1253461

Other

425

427

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-f8h4-46xv-h7jj/GHSA-f8h4-46xv-h7jj.json"