GitHub Advisoryadvisory · Maven

GHSA-rh72-238f-g26q Jenkins Azure CLI Plugin does not restrict the commands it executes

HIGH Published 2025-10-29 Modified 2025-11-05 Official page ↗
Aliases
CVE-2025-64140
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:azure-cli
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2025-10-29

Affected packages

• Maven org.jenkins-ci.plugins:azure-cli: <= 0.9 (no fix yet)

Description

Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller. This allows attackers with Item/Configure permission to execute arbitrary shell commands on the Jenkins controller. As of publication of this advisory, there is no fix.

Related

Alias · CVE (1)

  • CVE-2025-64140 Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References