CVE-2026-57282

The Jenkins Git client Plugin versions 6.6.0 and earlier are vulnerable to OS command injection on Unix agents. The flaw exists because the plugin fails to correctly escape the workspace directory name when it is embedded into an SSH wrapper script generated by the "Manually provided keys" Git Ho...

CVE-2025-67640

The Jenkins Git client Plugin (version 6.4.0 and earlier ) is vulnerable to OS command injection on agents. The root cause is the failure to correctly escape the path to the workspace directory when it is used as an argument in a temporary shell script generated by the plugin. An attacker who can...