GHSA-CJHR-43R9-CFMW pnpm binds unscoped user-level npm auth credentials to a repository-selected registry

Summary pnpm can send user-level unscoped npm authentication credentials to a registry chosen by a repository-local .npmrc file. In the reproduced case, the user's npm config contains a default registry and an unscoped authToken. The repository does not provide a token-bearing auth line. It only...

CVE-2026-42520

Jenkins Credentials Binding Plugin 719.v80e905ef14eb and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins...

CVE-2026-48922

Jenkins Credentials Binding Plugin 720.v3f6decef43ea and earlier does not properly sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution i...

Directory Traversal

Overview org.jenkins-ci.plugins:credentials-binding is a plugin that allows credentials to be bound to environment variables for use from miscellaneous build steps. Affected versions of this package are vulnerable to Directory Traversal due to improper sanitization of file names for file and zip...

GHSA-FXXF-W25W-MCX2 Jenkins Credentials Binding Plugin does not properly sanitize file names for file and zip file credentials

Jenkins Credentials Binding Plugin 720.v3f6decef43ea and earlier does not properly sanitize file names for file and zip file credentials. This allows attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem. If Jenkins is configured to allow a...

io.jenkins.blueocean:blueocean (>=1.1.0-beta-1, <=1.2.0-beta-1), io.jenkins.blueocean:blueocean-events (>=1.1.0-beta-1, <=1.2.0-beta-1) +16 more potentially affected by CVE-2026-48922 via org.jenkins-ci.plugins:credentials-binding (1.11)

org.jenkins-ci.plugins:credentials-binding MAVEN version 1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - io.jenkins.blueocean:blueocean =1.1.0-beta-1, =1.1.0-beta-1, =1.1.0-beta-1,...

org.jenkins-ci.plugins:templating-engine (>=2.3, <=2.5.3) potentially affected by CVE-2026-48922 via org.jenkins-ci.plugins:credentials-binding (1.24)

org.jenkins-ci.plugins:credentials-binding MAVEN version 1.24 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - org.jenkins-ci.plugins:templating-engine =2.3, =2.5.3 Source cves:...

org.jenkins-ci.plugins:docker-build-step (>=2.4, <=2.8) potentially affected by CVE-2026-48922 via org.jenkins-ci.plugins:credentials-binding (1.18)

org.jenkins-ci.plugins:credentials-binding MAVEN version 1.18 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - org.jenkins-ci.plugins:docker-build-step =2.4, =2.8 Source cves:...

au.com.versent.jenkins.plugins:ignore-committer-strategy (29.v7c3891a_434c3), com.cloudbees.jenkins.plugins:amazon-ecr (1.151.vb_ca_71ddd0b_cf) +22 more potentially affected by CVE-2026-48922 via org.jenkins-ci.plugins:credentials-binding (681.vf91669a_32e45)

org.jenkins-ci.plugins:credentials-binding MAVEN version 681.vf91669a32e45 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - au.com.versent.jenkins.plugins:ignore-committer-strategy...

org.jenkins-ci.plugins:pipeline-maven (>=1719.v0a_884457729c, <=1724.vfcd808f49a_0c) potentially affected by CVE-2026-48922 via org.jenkins-ci.plugins:credentials-binding (720.v3f6decef43ea)

org.jenkins-ci.plugins:credentials-binding MAVEN version 720.v3f6decef43ea is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - org.jenkins-ci.plugins:pipeline-maven =1719.v0a884457729c,...

com.amazon.jenkins.fleet:ec2-fleet (>=4.2.2.527.v38a_8758950a_0, <=4.2.3.540.va_6eedb_7b_c112), com.cloudbees.jenkins.plugins:amazon-ecs (1.50) +17 more potentially affected by CVE-2026-48922 via org.jenkins-ci.plugins:credentials-binding (696.v256688029804)

org.jenkins-ci.plugins:credentials-binding MAVEN version 696.v256688029804 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - com.amazon.jenkins.fleet:ec2-fleet =4.2.2.527.v38a8758950a0,...

org.jenkins-ci.plugins:ec2 (>=1822.v87175d209b_b_5, <=1856.vf40220e7a_75f) potentially affected by CVE-2026-48922 via org.jenkins-ci.plugins:credentials-binding (642.v737c34dea_6c2)

org.jenkins-ci.plugins:credentials-binding MAVEN version 642.v737c34dea6c2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - org.jenkins-ci.plugins:ec2 =1822.v87175d209bb5,...

io.jenkins.blueocean:blueocean (>=1.0.0-b13, <=1.0.0-b21), io.jenkins.blueocean:blueocean-dashboard (>=1.0.0-b15, <=1.0.0-b21) +7 more potentially affected by CVE-2026-48922 via org.jenkins-ci.plugins:credentials-binding (1.9)

org.jenkins-ci.plugins:credentials-binding MAVEN version 1.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - io.jenkins.blueocean:blueocean =1.0.0-b13, =1.0.0-b15, =1.0.0-b15, =1.0.0-b15...

io.jenkins.plugins:artifactory-artifact-manager (>=318.v89d9642e6690, <=320.v6d1b_a_84b_16db), org.csanchez.jenkins.plugins:kubernetes (>=4467.vf26561292824, <=4560.vc25b_83890c34) +1 more potentially affected by CVE-2026-48922 via org.jenkins-ci.plugins:credentials-binding (719.v80e905ef14eb)

org.jenkins-ci.plugins:credentials-binding MAVEN version 719.v80e905ef14eb is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - io.jenkins.plugins:artifactory-artifact-manager...

com.testinium.jenkins:testinium (1.0), io.jenkins.blueocean:blueocean (>=1.0.0-b22, <=1.0.1) +17 more potentially affected by CVE-2026-48922 via org.jenkins-ci.plugins:credentials-binding (1.10)

org.jenkins-ci.plugins:credentials-binding MAVEN version 1.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - com.testinium.jenkins:testinium 1.0 - io.jenkins.blueocean:blueocean...

com.amazon.jenkins.fleet:ec2-fleet (>=1.0, <=1.17.3), com.cloudbees.jenkins.plugins:amazon-ecr (1.6) +10 more potentially affected by CVE-2026-48922 via org.jenkins-ci.plugins:credentials-binding (1.7)

org.jenkins-ci.plugins:credentials-binding MAVEN version 1.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - com.amazon.jenkins.fleet:ec2-fleet =1.0, =1.4, =0.3, =1.2.2, =1.13, =1.0.0,...

org.jenkinsci.plugins:pipeline-model-definition (>=1.2.6, <=1.2.7), org.waveywaves.jenkins.plugins:tekton-client (1.1.0) potentially affected by CVE-2026-48922 via org.jenkins-ci.plugins:credentials-binding (1.13)

org.jenkins-ci.plugins:credentials-binding MAVEN version 1.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - org.jenkinsci.plugins:pipeline-model-definition =1.2.6, =1.2.7 -...

org.jenkins-ci.plugins:pipeline-maven (>=1719.v0a_884457729c, <=1724.vfcd808f49a_0c) potentially affected by CVE-2026-48922 via org.jenkins-ci.plugins:credentials-binding (720.v3f6decef43ea)

org.jenkins-ci.plugins:credentials-binding MAVEN version 720.v3f6decef43ea is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - org.jenkins-ci.plugins:pipeline-maven =1719.v0a884457729c,...

com.coravy.hudson.plugins.github:github (>=1.46.0, <=1.47.0), com.fuzzpro.jenkins-plugins:multibranch-job-tear-down (>=61.v68b_d7264b_643, <=73.ve2b_957fc2921) +39 more potentially affected by CVE-2026-48922 via org.jenkins-ci.plugins:credentials-binding (702.vfe613e537e88)

org.jenkins-ci.plugins:credentials-binding MAVEN version 702.vfe613e537e88 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - com.coravy.hudson.plugins.github:github =1.46.0,...

org.jenkins-ci.plugins:config-file-provider (>=973.vb_a_80ecb_9a_4d0, <=980.v88956a_a_5d6a_d), org.jenkins-ci.plugins:nodejs (>=1.6.2, <=1.6.4) +2 more potentially affected by CVE-2026-48922 via org.jenkins-ci.plugins:credentials-binding (657.v2b_19db_7d6e6d)

org.jenkins-ci.plugins:credentials-binding MAVEN version 657.v2b19db7d6e6d is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials-binding and may be impacted: - org.jenkins-ci.plugins:config-file-provider =973.vba80ecb9a4d0,...