Skip to content
fr Sign in
5.0 Medium

CVE-2025-67640 Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of…

Description

Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands.

Affected products and versions

Product Affected versions Fixed in
Jenkins Git Client Plugin 6.4 earliest → 6.4.0 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Jenkins Git Client Plugin

The 5 CVEs of Jenkins Git Client Plugin →
CVE-2026-57282 Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded… 5.0 Medium CVE-2025-58458 In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ… 4.3 Medium CVE-2022-36881 Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git… Not rated CVE-2019-10392 Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an… Not rated
Track this CVE