PT-2025-50358 · Jenkins · Jenkins Git Client Plugin+1

Published 2025-12-10 · Updated 2025-12-14 · CVE-2025-67640

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Jenkins Git client Plugin versions 6.4.0 and earlier

Description The Jenkins Git client Plugin does not properly escape the path to the workspace directory when creating a temporary shell script. This allows attackers who can control the workspace directory name to inject and execute arbitrary operating system commands.

Recommendations Update to a version later than 6.4.0.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-15962

CVE-2025-67640

GHSA-V8HG-M323-JVJQ

Affected Products

Jenkins

Jenkins Git Client Plugin

References · 6

• https://jenkins.io/security/advisory/2025-12-10/#SECURITY-3614 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67640 · Security Note
• https://bdu.fstec.ru/vul/2025-15962 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67640 · Vendor Advisory
• https://twitter.com/CVEnew/status/2000248623788167614 · Twitter Post
• https://t.me/CVEtracker/39381 · Telegram Post