CVE-2025-67640 — Jenkins Project / Jenkins Git client Plugin

CVE-2025-67640

Jenkins Project / Jenkins Git client Plugin PUBLISHED

Description (CNA)

Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands.

Affected (CNA)

Vendor / product	Versions
Jenkins Project / Jenkins Git client Plugin	affected 0 through 6.4.0

CWE

No CWE identifiers supplied.

References

https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3614

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.