CVE-2025-67640
Medium · 5.0Jenkins Git client Plugin has an OS command injection vulnerability on agents in Git client Plugin
CVSS
5.0
EPSS
0.2%
Published
Dec 10, 2025
CISA due date
—
The record
Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:git-client | 0 | 6.4.1 |
Related vulnerabilities
- GHSA-v8hg-m323-jvjq Jenkins Git client Plugin has an OS command injection vulnerability on agents in Git… Same vulnerability
- CVE-2026-96376 Improper Neutralization of Special Elements used in an OS Command ("OS Command… CWE-78
- CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113726 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113725 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113722 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-112943 launch-editor allows users to open files with line numbers in editor from Node.js. CWE-78