Jenkins Git client Plugin has an OS command injection vulnerability on agents in Git client Plugin

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-67640 · ADVISORY
• jenkinsci/git-client-plugin commit 5a271e5 · WEB
• jenkinsci/git-client-plugin · PACKAGE
• jenkins.io/security/advisory/2025-12-10 · WEB

More vulnerabilities in org.jenkins-ci.plugins:git-client

• CVE-2026-57282MEDIUM 5.0Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded into a generated SSH …
• CVE-2025-58458MEDIUM 4.3In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the …
• CVE-2022-36881HIGH 8.1Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enablin…
• CVE-2019-10392HIGH 8.8Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls…
• CVE-2017-1000242LOW 3.3Jenkins Git Client Plugin 2.4.2 and earlier creates temporary file with insecure permissions resulting in information disclosure