GitHub Advisoryadvisory · Maven

GHSA-v8hg-m323-jvjq Jenkins Git client Plugin has an OS command injection vulnerability on agents in Git client Plugin

MEDIUM Published 2025-12-10 Modified 2025-12-10 Official page ↗
Aliases
CVE-2025-67640
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:git-client
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-78
Reviewed
2025-12-10

Affected packages

• Maven org.jenkins-ci.plugins:git-client: < 6.4.1 → fixed in 6.4.1

Description

Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands.

Related

Alias · CVE (1)

  • CVE-2025-67640 Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References