CVE-2025-67640: Jenkins Git Client Plugin OS Command Injection Vulnerability
Summary
CVE-2025-67640: Jenkins Git client Plugin has an OS command injection vulnerability on agents in Git client Plugin. Affects org.jenkins-ci.plugins:git-client versions < 6.4.1. Fixed in 6.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Git Client Plugin is a widely used plugin that integrates Git version control into Jenkins, allowing users to manage their source code repositories effectively. This plugin facilitates various Git operations, enabling continuous integration and delivery workflows. However, it has been identified that versions 6.4.0 and earlier are susceptible to an OS command injection vulnerability due to improper handling of workspace directory paths.
Vulnerability Detail
The vulnerability arises from the Jenkins Git Client Plugin not correctly escaping the path to the workspace directory when generating a temporary shell script. This oversight allows attackers who can manipulate the workspace directory name to inject arbitrary OS commands, potentially leading to unauthorized access or control over the system running the Jenkins agent. The vulnerability is classified under CWE-78, indicating a command injection issue.
How To Fix
Minimum fixed version
6.4.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the workspace directory names are controlled and do not contain any special characters or spaces that could be exploited for command injection. However, this is not a permanent solution and updating the plugin is strongly recommended.
Conclusion
The Jenkins Git Client Plugin has a critical OS command injection vulnerability that affects versions 6.4.0 and earlier. Users are advised to update to version 6.4.1 or later to mitigate this risk. Additionally, controlling workspace directory names can serve as a temporary workaround, but updating the plugin is the recommended approach.
See every vulnerability recorded for org.jenkins-ci.plugins:git-client →
FAQ
The CVSS score of this vulnerability is 5.0, indicating a moderate severity level.
Versions 6.4.0 and earlier of the Jenkins Git Client Plugin are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability could allow attackers to execute arbitrary OS commands on the Jenkins agent, leading to unauthorized access or control over the system.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the pom.xml file.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:git-client.
