CVE-2019-10392

CVE-2019-10392 affects Jenkins Git Client Plugin (versions ≤2.8.4 and 3.0.0-rc): improper restriction of values passed to git ls-remote enables OS command injection. Exploitation details are present in a public exploit repository (GitHub). NVD CVSSv3.1 base score 8.8 (HIGH). Connected advisories ...

CVE-2022-36881

CVE-2022-36881 affects Jenkins Git client plugin and is disclosed across multiple sources (including GHSA and OSV). The issue: Git client plugin 3.11.0 and older does not perform SSH host key verification when connecting to Git repositories over SSH, enabling Man-in-the-Middle attacks. Impact des...

CVE-2017-1000242

CVE-2017-1000242 affects Jenkins Git Client Plugin 2.4.2 and earlier, where temporary files are created with insecure permissions, enabling information disclosure. The known impact is information leakage due to insecure file permissions; exploitation details are not provided in the available docu...

CVE-2025-58458

The Jenkins Git client Plugin (version 6.3.2 and earlier, except 6.1.4 and 6.2.1) is vulnerable to a file system information disclosure vulnerability. The root cause is that the Git URL field form validation responses differ depending on whether a specified file path exists on the controller when...

CVE-2026-57282

Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded into a generated SSH wrapper script, allowing attackers able to control the name of a build's working directory to execute arbitrary operating system commands on the agent.

CVE-2025-67640

The Jenkins Git client Plugin (version 6.4.0 and earlier ) is vulnerable to OS command injection on agents. The root cause is the failure to correctly escape the path to the workspace directory when it is used as an argument in a temporary shell script generated by the plugin. An attacker who can...