CVE-2025-67640

Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands...

org.jenkins-ci.plugins:assembla-merge-request-builder (>=1.1.1, <=1.1.13), org.jenkins-ci.plugins:bitbucket-pullrequest-builder (>=1.4.6, <=1.4.28) +5 more potentially affected by CVE-2025-67640 via org.jenkins-ci.plugins:git-client (1.10.1)

org.jenkins-ci.plugins:git-client MAVEN version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - org.jenkins-ci.plugins:assembla-merge-request-builder =1.1.1, =1.4.6, =1.13-1, =2.2.3, =1.0....

org.jenkins-ci.plugins:git (>=2.2.6, <=2.3-beta-3), org.jenkins-ci.plugins:git-tag-message (>=1.0, <=1.5) +1 more potentially affected by CVE-2025-67640 via org.jenkins-ci.plugins:git-client (1.10.2)

org.jenkins-ci.plugins:git-client MAVEN version 1.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - org.jenkins-ci.plugins:git =2.2.6, =1.0, =0.1-beta-3, =0.1-beta-8 Source cves: CVE-2025-6764...

org.jenkins-ci.plugins:git (2.0-beta-2) potentially affected by CVE-2025-67640 via org.jenkins-ci.plugins:git-client (1.3.0)

org.jenkins-ci.plugins:git-client MAVEN version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - org.jenkins-ci.plugins:git 2.0-beta-2 Source cves: CVE-2025-67640 Source advisory:...

org.jenkins-ci.plugins:git (>=2.2.11, <=2.3.4), org.jenkins-ci.plugins:github-pullrequest (>=0.0.1-beta7, <=0.0.1-beta12) +2 more potentially affected by CVE-2025-67640 via org.jenkins-ci.plugins:git-client (1.15.0)

org.jenkins-ci.plugins:git-client MAVEN version 1.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - org.jenkins-ci.plugins:git =2.2.11, =0.0.1-beta7, =0.4.0, =1.0, =1.3 Source cves:...

org.jenkins-ci.plugins:git (>=2.5.0-beta2, <=2.5.0-beta3) potentially affected by CVE-2025-67640 via org.jenkins-ci.plugins:git-client (1.20.0-beta2)

org.jenkins-ci.plugins:git-client MAVEN version 1.20.0-beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - org.jenkins-ci.plugins:git =2.5.0-beta2, =2.5.0-beta3 Source cves: CVE-2025-67640 Sour...

com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger (>=2.8.0, <=2.10.1), org.jenkins-ci.plugins:git (1.2.0) potentially affected by CVE-2025-67640 via org.jenkins-ci.plugins:git-client (1.0.2)

org.jenkins-ci.plugins:git-client MAVEN version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger =2.8.0, =2.10.1 -...

au.com.versent.jenkins.plugins:ignore-committer-strategy (29.v7c3891a_434c3), com.tikalk.hudson.plugins:notification (1.18) +10 more potentially affected by CVE-2025-67640 via org.jenkins-ci.plugins:git-client (5.0.0)

org.jenkins-ci.plugins:git-client MAVEN version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - au.com.versent.jenkins.plugins:ignore-committer-strategy 29.v7c3891a434c3 -...

CVE-2025-67640

Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands...

CVE-2025-67640

Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands...