CVE-2026-57282: Jenkins Git Client Plugin OS Command Injection Vulnerability
Summary
CVE-2026-57282: Jenkins Git client Plugin has an OS command injection vulnerability on agents. Affects org.jenkins-ci.plugins:git-client versions < 6.6.1. Fixed in 6.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Git Client Plugin is a widely used plugin in Jenkins that facilitates the integration of Git repositories into Jenkins jobs. It allows users to manage Git repositories, perform version control operations, and automate builds. The plugin is essential for teams that rely on Git for source code management. However, versions 6.6.0 and earlier have a critical vulnerability that can be exploited if an attacker can control the name of a build's working directory.
Vulnerability Detail
The vulnerability arises from the improper escaping of the workspace directory name in the SSH wrapper script generated by the 'Manually provided keys' Git Host Key Verification strategy on Unix agents. This flaw allows an attacker to inject shell command substitution, potentially executing arbitrary commands on the agent. The risk is particularly significant when attackers can influence the working directory name through build parameters, while not having control over the Pipeline itself or the scripts executed.
How To Fix
Minimum fixed version
6.6.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using build parameters that allow users to control the workspace directory name. Ensure that the directory names are sanitized and do not contain any special characters that could be exploited.
Conclusion
The Jenkins Git Client Plugin vulnerability (CVE-2026-57282) poses a risk of OS command injection on Unix agents. Users are advised to update to version 6.6.1 or later to mitigate this risk. Proper input sanitization and monitoring tools like Vulert can help manage vulnerabilities effectively.
See every vulnerability recorded for org.jenkins-ci.plugins:git-client →
FAQ
The CVSS score of this vulnerability is 5.0, indicating a moderate severity level.
Versions 6.6.0 and earlier of the Jenkins Git Client Plugin are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
If you cannot update the plugin immediately, ensure that you sanitize any user-controlled input that could affect the workspace directory name to mitigate the risk.
Yes, you can automate the update process for Jenkins plugins using scripts or tools that interact with the Jenkins API or by using the Jenkins plugin manager.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:git-client.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
