Technical impact
The Jenkins GitHub Plugin up to version 1.46.0 improperly includes the current job URL in a JavaScript validation routine for the GitHub hook trigger feature. This flaw allows a non‑anonymous attacker who has Overall or Read permissions to persist malicious script code in the job configuration, which will then be executed in the browser context of any user who views that job. The result is a classic stored XSS vulnerability that can lead to credential theft, session hijacking, or arbitrary data exfiltration
Affected Systems
All installations of Jenkins using the Jenkins GitHub Plugin v1.46.0 or older are affected. This includes environments where the plugin has been deployed without upgrading to the latest releases
Risk and Exploitability
The vulnerability is exploitable only by users who can trigger a GitHub hook and have read access to the job. Attackers can craft a payload that is ingested when the trigger is processed, which will be served to any viewer of the job page. The CVSS score is 9, indicating high severity. EPSS score is unavailable, but the absence of a KEV listing does not mitigate the high risk associated with stored XSS. The attack vector is inferred to be a legitimate feature misuse rather than external network access. The potential impact includes compromise of user sessions and defacement of job listings.
Github GHSA