The Jenkins GitHub Plugin up to version 1.46.0 improperly handles the current job URL in JavaScript validation code for the GitHub hook trigger feature. This flaw allows stored cross-site scripting (XSS) attacks, where malicious script code can be injected and executed in the context of Jenkins. Exploitation requires the attacker to have non-anonymous access with Overall/Read permissions, limiting the attack surface to authenticated users with at least read-level privileges.

Successful exploitation of this vulnerability could allow an attacker with Overall/Read permissions to execute arbitrary JavaScript in the context of Jenkins users' browsers. This could lead to session hijacking, unauthorized actions, or other malicious activities within the Jenkins environment. However, exploitation requires authenticated access, which reduces the risk from anonymous or external attackers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Overall/Read permissions to trusted users only and monitor for suspicious activity related to the GitHub hook trigger feature. Avoid enabling the vulnerable feature if possible.