Jenkins Project Jenkins Git Client Plugin vulnerabilities

4 vulnerabilities

Known vulnerabilities in Jenkins Project Jenkins Git Client Plugin, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5CVE-2025-67640jenkins projectjenkins git client plugin+2
EPSS score
0.21%
Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands.8.1CVE-2022-36881jenkins projectjenkins git client plugin+3
EPSS score
1.02%
Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks.8.8CVE-2019-10392jenkins projectjenkins git client plugin+32
EPSS score
26.23%
Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection.5CVE-2026-57282jenkins projectjenkins git client plugin+2
EPSS score
0.25%
Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded into a generated SSH wrapper script, allowing attackers able to control the name of a build's working directory to execute arbitrary operating system commands on the agent.