Jenkins Git Client Plugin
Monthly
OS command injection in Jenkins Git Client Plugin 6.6.0 and earlier enables low-privileged authenticated attackers who can control a build's working directory name to execute arbitrary commands on the Jenkins agent. The plugin fails to escape the workspace directory path before embedding it into a dynamically generated SSH wrapper script, meaning shell metacharacters in the directory name are interpreted by the OS shell. No active exploitation is confirmed - EPSS is 0.18% (8th percentile) and SSVC exploitation status is 'none' - but the risk is meaningful in multi-tenant Jenkins environments where developers can define custom workspace names via Jenkinsfiles.
OS command injection in Jenkins Git Client Plugin 6.6.0 and earlier enables low-privileged authenticated attackers who can control a build's working directory name to execute arbitrary commands on the Jenkins agent. The plugin fails to escape the workspace directory path before embedding it into a dynamically generated SSH wrapper script, meaning shell metacharacters in the directory name are interpreted by the OS shell. No active exploitation is confirmed - EPSS is 0.18% (8th percentile) and SSVC exploitation status is 'none' - but the risk is meaningful in multi-tenant Jenkins environments where developers can define custom workspace names via Jenkinsfiles.