EUVD-2026-70148
GHSA-2g8p-r374-fc4m
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
OS command injection yields full agent-node compromise (C:H/I:H/A:H); PR:L required for job-configuration access; S:C because impact falls on the agent, not the controller.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
4DescriptionCVE.org
OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build.
Articles & Coverage 2
AnalysisAI
OS command injection in Jenkins TICS Plugin 2025.1.1 and earlier allows an authenticated, low-privileged Jenkins user who can control build environment variable values to execute arbitrary commands on the build agent hosting the job. The flaw stems from unsanitized environment variable values being passed directly to OS command invocations within the plugin, and the scope change (S:C) means impact falls on the agent node rather than the Jenkins controller. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a Jenkins account with sufficient permissions to control build environment variable values - this includes users who can edit job configurations, trigger parameterized builds with custom variable inputs, or inject variables through other Jenkins mechanisms (shared libraries, global properties if writable). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 7.4 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) requires low privilege but no other special complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Jenkins TICS Plugin to a version beyond 2025.1.1 per the vendor advisory at https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3987. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Jenkins deployments using TICS Plugin 2025.1.1 or earlier and audit which user roles can create or modify build jobs and set environment variables. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today