CVE-2026-42524: Stored XSS in Jenkins HTML Publisher Plugin Legacy Wrapper

Vulnerability Overview

Jenkins HTML Publisher Plugin versions 427 and earlier contain a stored cross-site scripting vulnerability (SECURITY-3706 / CVE-2026-42524, CVSS 8.0 HIGH) in the legacy wrapper file generation path. When the plugin renders the wrapper HTML file that frames published reports, it interpolates the job name and job URL directly into the document without HTML entity encoding. An attacker holding Item/Configure permission — a role commonly granted to developers in CI environments — can craft a job name containing JavaScript payload that executes in the browser of any user who opens the published HTML report.

This class of vulnerability is particularly dangerous in Jenkins because the HTML Publisher Plugin is ubiquitous: it is used to archive test coverage reports, API documentation, and static analysis output. The stored payload persists in the wrapper file on the Jenkins controller filesystem and fires for every subsequent viewer, including administrators.

Affected Component

The vulnerable surface lives inside the HTML Publisher Plugin's wrapper file writer, specifically in the Groovy/Java class HtmlPublisherTarget and the Jelly/Groovy template that generates htmlpublisher-wrapper.html. The wrapper is a redirect shim written to the archived report directory; it references the job name in a visible title element and encodes the originating job URL in a JavaScript variable for navigation purposes.

Plugin artifact : htmlpublisher.hpi
Affected versions: ≤ 427
Fixed version    : 428 (released 2026-04-29)
Jenkins advisory : https://www.jenkins.io/security/advisory/2026-04-29/#SECURITY-3706
Permission needed: Item/Configure
Impact scope     : Stored XSS → session hijack / credential theft of any report viewer

Root Cause Analysis

The legacy wrapper file is emitted by HtmlPublisherTarget.wrapIndex(). The method constructs the wrapper HTML using Java string formatting, pulling the display name and absolute URL of the owning job from the Jenkins model. Neither value is sanitized before insertion.

// HtmlPublisherTarget.java (reconstructed from bytecode, plugin ≤427)
// Equivalent pseudocode — field names match decompiled output.

private void wrapIndex(Run run, FilePath archiveDir) throws IOException {
    String jobName   = run.getParent().getFullDisplayName();  // attacker-controlled
    String jobUrl    = run.getParent().getAbsoluteUrl();      // attacker-controlled (display name in path)
    String reportDir = this.reportDir;
    String indexPage = this.reportFiles;

    // BUG: jobName and jobUrl written into HTML without escaping
    String wrapperContent = "\n"
        + "\n"          // XSS vector 1
        + "\n"
        + "\n"
        + "\n";

    FilePath wrapperFile = archiveDir.child("htmlpublisher-wrapper.html");
    wrapperFile.write(wrapperContent, "UTF-8");   // persisted to disk
}

Two distinct injection points exist. The <title> element closes trivially with </title><script>...</script><title> in the job display name. The rootURL JavaScript string literal breaks out with a single quote, allowing direct script injection inside the existing <script> block — no tag boundary crossing required for the second vector.

Exploitation Mechanics

EXPLOIT CHAIN (Item/Configure → stored XSS → admin session theft):

1. Attacker authenticates to Jenkins with a user account that holds
   Item/Configure on any pipeline or freestyle job.

2. Attacker sets the job display name to a crafted string via
   Configure → Advanced → Display Name:

     Payload (title vector):
       Reports


─────────────────────────────────────────────────────────────────────

DOM STATE — AFTER INJECTION (title vector):






Parser enters 

No tag injection required. Single-quote breaks string context.
Semicolon terminates rootURL assignment.
Double-slash comments out remainder of the original line.

Patch Analysis

The fix introduced in plugin version 428 routes both interpolated values through Jenkins' standard HTML escaping utility before concatenation. For the JavaScript context the URL is additionally validated against the Jenkins root URL to prevent open-redirect chaining.

// BEFORE (vulnerable, ≤427):
String wrapperContent = "\n"
    + "\n"
    + "\n";


// AFTER (patched, 428):
import hudson.Util;

String safeJobName = Util.escape(jobName);          // HTML entity encoding
String safeJobUrl  = Util.escape(jobUrl);           // breaks JS string injection too

String wrapperContent = "\n"
    + "\n"
    + "\n";

Util.escape() converts the five HTML special characters (&, <, >, ", ') to their named or numeric entities. Critically, encoding ' to ' inside the JavaScript string literal neutralises the string break-out vector independently of the tag injection fix, so either encoding call alone would have been sufficient to block both chains. The patch applies both, which is correct defence in depth.

Detection and Indicators

Audit existing wrapper files on the Jenkins controller for injection. The wrapper is always named htmlpublisher-wrapper.html and lives under each build's archived report directory.

# scan_wrappers.py — detect injected htmlpublisher-wrapper.html files
import os, re, sys

JENKINS_HOME = os.environ.get("JENKINS_HOME", "/var/lib/jenkins")
REPORT_ROOT  = os.path.join(JENKINS_HOME, "jobs")

# Patterns indicating XSS payload in wrapper
INDICATORS = [
    re.compile(r"", re.IGNORECASE),          # tag break in title context
    re.compile(r"