jenkinsci/git-client-plugin · Security
Jenkins Git client Plugin has an OS command injection vulnerability on agents in Git client Plugin
- GHSA ID
- GHSA-v8hg-m323-jvjq
- CVE ID
- CVE-2025-67640
- Severity
- medium
- Published
- Updated
- CVSS
- 5 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
- CVSS v3
- 5 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Description
Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands.
CWEs
- CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')