| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins.workflow:workflow-cps | ≥ 2.93, < 2.94.1≥ 2646.v6ed3b5b01ff1, < 2656.vf7a< 2.92.1 | 2.94.12656.vf7a2.92.1 |
| pipeline | ≤ 2648.va9433432b33c |
Jenkins Pipeline: Groovy Plugin prior to 2656.vf7a_e7b_75a_457, 2.94.1, and 2.92.1 uses the same checkout directories for distinct SCMs when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free