Jenkins Git client CVE-2025-67640

Exploitation requires the attacker to control the name of the workspace directory used by the Git client plugin - in practice this means a user with sufficient Jenkins privileges to configure a job, set a custom workspace path, or otherwise influence how the workspace directory is named on a controller or build agent. The limiting factors are significant: it is not remote-unauthenticated (PR:L - some authenticated/configuration-level access is needed), AC:H reflects that merely reaching Jenkins is insufficient (the attacker must specifically achieve influence over the workspace naming), and the affected component must be Git client Plugin 6.4.0 or earlier. Environments where only trusted administrators configure jobs face substantially lower real-world risk than multi-tenant Jenkins instances allowing less-trusted users to define job/workspace settings.

This is a genuine-but-low-priority vulnerability, and multiple signals agree. The CVSS base score of 5.0 (Medium) is driven down by AC:H (high attack complexity - the attacker must achieve control over the workspace directory name, which is not trivially satisfied) and PR:L (some authenticated/configuration privilege is required), with only partial C:L/I:L/A:L impact. EPSS reinforces this: a 0.21% exploitation probability at the 11th percentile indicates very low likelihood of near-term broad exploitation. The vulnerability is NOT in CISA KEV (no confirmed active exploitation) and no public exploit code is referenced, so there is no evidence of weaponization. No SSVC decision data was provided in the input. The CWE-78 OS command injection with scope-unchanged (S:U) means impact is confined to the context in which the shell script runs (a Jenkins controller/agent build environment). Signals are internally consistent - there is no conflict between CVSS, EPSS, and KEV; all point to a legitimate command-injection flaw that requires meaningful preconditions and is unlikely to be mass-exploited. Prioritize patching in Jenkins environments where untrusted users can influence job/workspace naming, but this does not warrant emergency response.

An attacker who already has enough Jenkins access to influence or control a build's workspace directory name crafts a name containing shell metacharacters. When the Git client plugin generates its temporary shell script without escaping the workspace path argument, the embedded payload is executed as OS commands in the build environment. No public proof-of-concept exploit is referenced in the available data.