CVE-2025-67640

Severity: medium (CVSS 5.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-10 · updated 2026-10-14
Weakness: CWE-78

Description

Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands.

Affected products

Jenkins Project Jenkins Git client Plugin: before 6.4.1 — fixed in 6.4.1

How to fix

Upgrade to a fixed version: Jenkins Project Jenkins Git client Plugin 6.4.1. Check the vendor advisory for mitigations.

References

https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3614

Get alerted when CVE-2025-67640 or the next vulnerability affects your stack