CVE-2019-10392

CVE-2019-10392 affects Jenkins Git Client Plugin (versions ≤2.8.4 and 3.0.0-rc): improper restriction of values passed to git ls-remote enables OS command injection. Exploitation details are present in a public exploit repository (GitHub). NVD CVSSv3.1 base score 8.8 (HIGH). Connected advisories ...

CVE-2022-36881

CVE-2022-36881 affects Jenkins Git client plugin and is disclosed across multiple sources (including GHSA and OSV). The issue: Git client plugin 3.11.0 and older does not perform SSH host key verification when connecting to Git repositories over SSH, enabling Man-in-the-Middle attacks. Impact des...

CVE-2017-1000242

CVE-2017-1000242 affects Jenkins Git Client Plugin 2.4.2 and earlier, where temporary files are created with insecure permissions, enabling information disclosure. The known impact is information leakage due to insecure file permissions; exploitation details are not provided in the available docu...

CVE-2025-58458

The Jenkins Git client Plugin (versions 6.3.2 and earlier, except 6.1.4 and 6.2.1) is vulnerable to an information disclosure flaw. The issue stems from differential form validation behavior when using the amazon-s3 protocol with JGit; specifically, the Git URL field validation responses vary dep...

CVE-2026-57282

The Jenkins Git client Plugin versions 6.6.0 and earlier are vulnerable to OS command injection on Unix agents. The flaw exists because the plugin fails to correctly escape the workspace directory name when it is embedded into an SSH wrapper script generated by the "Manually provided keys" Git Ho...

CVE-2025-67640

The Jenkins Git client Plugin (version 6.4.0 and earlier ) is vulnerable to OS command injection due to the improper escaping of the workspace directory path. When the plugin generates a temporary shell script, it fails to neutralize special elements in the path, allowing an attacker who can cont...