CVE-2026-42524

Jenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper file

8.0 HighFix available

Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.28%Up 0.2 points since Apr 30, 2026

What each source reports

CVE List Score used 8.0

Record: CVE-2026-42524
CVSS 3.1: 8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2026-26226 8.0

Record: EUVD-2026-26226
CVSS 3.1: 8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-f8h4-46xv-h7jj 8.0

Jenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper file

Jenkins HTML Publisher Plugin versoins 427 and earlier do not escape the job name and URL in the legacy wrapper file.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

HTML Publisher Plugin 427.1 escapes job name and URL when generating the legacy wrapper file.

Record: GHSA-f8h4-46xv-h7jj
CVSS 3.1: 8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-79
Updated: 2026-11-02

NVD 8.0

Record: CVE-2026-42524
CVSS 3.1: 8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-79
Updated: 2026-11-02

OSV 8.0

Record: CVE-2026-42524
CVSS 3.1: 8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-f8h4-46xv-h7jj 8.0

Jenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper file

Jenkins HTML Publisher Plugin versoins 427 and earlier do not escape the job name and URL in the legacy wrapper file.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

HTML Publisher Plugin 427.1 escapes job name and URL when generating the legacy wrapper file.

Record: GHSA-f8h4-46xv-h7jj
CVSS 3.1: 8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-79
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.jenkins-ci.plugins:htmlpublisher` Maven	before 427.1	427.1
`org.jenkins-ci.plugins:htmlpublisher` Maven	before 427.1, plus listed versions 0.70.81.01.11.10 Show 41 moreShow less 1.111.121.131.141.151.161.16.11.171.181.191.21.201.211.221.22-beta-11.231.241.251.261.271.281.291.31.301.311.321.32.11.331.341.351.361.371.41.51.61.71.81.9424.va_e57f1253461425427	427.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-42524 is a high vulnerability (CVSS 8.0) in Jenkins Html Publisher, published April 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in org.jenkins-ci.plugins:htmlpublisher 427.1.