GHSA-v8hg-m323-jvjq

Suggest an improvement
Source
https://github.com/advisories/GHSA-v8hg-m323-jvjq
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-v8hg-m323-jvjq/GHSA-v8hg-m323-jvjq.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-v8hg-m323-jvjq
Aliases
Published
2025-12-10T18:30:26Z
Modified
2025-12-10T20:26:15Z
Severity
  • 5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Jenkins Git client Plugin has an OS command injection vulnerability on agents in Git client Plugin
Details

Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands.

Database specific 
{
    "cwe_ids":  [
        "CWE-78"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-12-10T20:14:28Z",
    "nvd_published_at":  "2025-12-10T17:15:56Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven / org.jenkins-ci.plugins:git-client

Package

Name
org.jenkins-ci.plugins:git-client
View open source insights on deps.dev
Purl
pkg:maven/org.jenkins-ci.plugins/git-client

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
6.4.1

Affected versions

1.*
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.1
1.1.1
1.1.2
1.2.0
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.5.0
1.5.1
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.7.0
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.10.0
1.10.1
1.10.2
1.11.0
1.11.1
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.1
1.17.0
1.17.1
1.18.0
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.20.0-beta1
1.20.0-beta2
1.20.0-beta3
1.20.2
1.21.0
2.*
2.0.0-beta1
2.0.0-beta2
2.0.0-beta3
2.0.0-beta4
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.4.4
2.4.5
2.4.6
2.5.0
2.6.0
2.7.0
2.7.1
2.7.2
2.7.3
2.7.3.1
2.7.4
2.7.4.1
2.7.5
2.7.6
2.7.7
2.7.7.1
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.9.0
3.*
3.0.0-beta1
3.0.0-beta2
3.0.0-beta3
3.0.0-beta4
3.0.0-beta5
3.0.0-beta6
3.0.0-beta7
3.0.0-beta8
3.0.0-beta9
3.0.0-beta10
3.0.0-beta11
3.0.0-beta12
3.0.0-rc
3.0.0
3.1.0-beta
3.1.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.4.2
3.5.0
3.5.1
3.6.0
3.7.0
3.7.1
3.7.2
3.8.0
3.9.0
3.10.0
3.10.0.1
3.10.0.2
3.10.1
3.11.0
3.11.1
3.11.2
3.12.0
3.12.1
3.12.2
3.12.4
3.13.0
3.13.1
4.*
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
4.5.0
4.6.0
4.7.0
5.*
5.0.0
5.0.1
5.0.2
5.0.3
6.*
6.0.0
6.1.0
6.1.1
6.1.2
6.1.3
6.1.4
6.1.5
6.2.0
6.2.1
6.3.0
6.3.1
6.3.2
6.3.3
6.4.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-v8hg-m323-jvjq/GHSA-v8hg-m323-jvjq.json"