Jenkins HTML Publisher Plugin Stored XSS via Unescaped Job Names

Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Jenkins HTML Publisher Plugin versions 427 and earlier contain a stored cross-site scripting (XSS) vulnerability in legacy wrapper files that fail to properly escape job names and URLs. This vulnerability is particularly significant because it allows attackers with Item/Configure permissions to inject malicious scripts that execute in the browsers of other Jenkins users when they view affected job configurations or reports. Organizations running vulnerable Jenkins instances with the HTML Publisher Plugin are at risk, especially those where multiple users have configuration access or where plugin permissions aren't strictly controlled. The stored nature of this vulnerability means the payload persists, creating an ongoing threat to all subsequent users who access the affected content.

Casky's 301 mapped skills leverage Claude AI's extended reasoning to detect the attack patterns behind this vulnerability by analyzing both initial access vectors (TA0001) and credential access techniques (TA0043) that often precede or follow XSS exploitation. Practitioners using Casky would see findings that identify improper input validation in plugin wrapper generation, detect JavaScript payloads in job configuration metadata, and flag suspicious HTML rendering in Jenkins UI responses. The platform's skills would specifically highlight the chain: an attacker with Item/Configure permission injecting unescaped payloads into job names, the plugin rendering those names without sanitization, and subsequent users experiencing script execution in their sessions. Security teams would receive alerts on unusual script execution contexts within Jenkins, potential credential harvesting attempts through injected forms, and anomalous API calls generated by injected JavaScript—enabling them to both identify compromised instances and prevent lateral movement within their Jenkins infrastructure.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-42524.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-42524

Casky has 301 skills that investigate the attack patterns behind CVE-2026-42524. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn