CVE-2025-53652: Jenkins Git Parameter Plugin Code Injection Vulnerability
Summary
CVE-2025-53652: Jenkins Git Parameter Plugin vulnerable to code injection due to inexhaustive parameter check. Affects org.jenkins-ci.tools:git-parameter versions < 444.vca. Fixed in 444.vca. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Git Parameter Plugin is a tool that allows users to create choice build parameters that list branches, tags, pull requests, and revisions from configured Git SCMs. This functionality is essential for Jenkins users who need to dynamically select Git references during builds. However, the plugin has a vulnerability that can be exploited if not properly managed.
Vulnerability Detail
The vulnerability arises from the Git Parameter Plugin versions 439.vb_0e46ca_14534 and earlier, which do not validate the Git parameter value submitted to the build against the offered choices. This lack of validation allows attackers with Item/Build permissions to inject arbitrary values into Git parameters, potentially leading to unauthorized actions or code execution. The issue is classified under CWE-1287 and CWE-20, indicating both improper validation and exposure to security risks.
How To Fix
Minimum fixed version
444.vca
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict Item/Build permissions to trusted users only, minimizing the risk of exploitation until the plugin can be updated.
Conclusion
The Jenkins Git Parameter Plugin has a vulnerability that allows for code injection due to insufficient validation of Git parameter values. Users are advised to update to the latest version to mitigate this risk. Additionally, using tools like Vulert can help monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for org.jenkins-ci.tools:git-parameter →
FAQ
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability could allow attackers to inject arbitrary values into Git parameters, leading to unauthorized actions or code execution during builds.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the pom.xml file.
If an immediate update is not possible, consider restricting access to Item/Build permissions to trusted users to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.tools:git-parameter.
