Jenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper file
Date: 2026-04
Affected: maven/org.jenkins-ci.plugins:htmlpublisher
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-42524
CWE: CWE-79
CVSS: 8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)

Jenkins HTML Publisher Plugin versoins 427 and earlier do not escape the job name and URL in the legacy wrapper file. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. HTML Publisher Plugin 427.1 escapes job name and URL when generating the legacy wrapper file.


Mitigations:

Architectural layers (MAESTRO):