Jenkins Azure CLI Plugin does not restrict the commands it executes

ALTO 8.8CVE-2025-64140 · GHSA-rh72-238f-g26q · Published 29/10/2025 · updated 08/10/2026

En resumen

CVE-2025-64140 es una vulnerabilidad ALTO (CVSS 8.8) que afecta a org.jenkins-ci.plugins:azure-cli, azure cli (jenkins).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.61%, mayor que el 49.3% de las vulnerabilidades.
Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:azure-cli Maven	`≤ 0.9`	No fix yet
azure cli jenkins	`≤ 0.9`	No fix yet

Description

Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller.

This allows attackers with Item/Configure permission to execute arbitrary shell commands on the Jenkins controller.

As of publication of this advisory, there is no fix.

NVD description

Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary shell commands.

References

nvd.nist.gov/vuln/detail/CVE-2025-64140 · ADVISORY
jenkinsci/azure-cli-plugin · PACKAGE
jenkins.io/security/advisory/2025-10-29 · WEB
openwall.com/lists/oss-security/2025/10/29/2 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free