CVE-2026-57282

The Jenkins Git client Plugin versions 6.6.0 and earlier are vulnerable to OS command injection on Unix agents. The flaw exists because the plugin fails to correctly escape the workspace directory name when it is embedded into an SSH wrapper script generated by the "Manually provided keys" Git Ho...

CVE-2025-67640

The Jenkins Git client Plugin (version 6.4.0 and earlier ) is vulnerable to OS command injection due to the improper escaping of the workspace directory path. When the plugin generates a temporary shell script, it fails to neutralize special elements in the path, allowing an attacker who can cont...