Jenkins Tics Plugin
Monthly
OS command injection in Jenkins TICS Plugin 2025.1.1 and earlier allows an authenticated, low-privileged Jenkins user who can control build environment variable values to execute arbitrary commands on the build agent hosting the job. The flaw stems from unsanitized environment variable values being passed directly to OS command invocations within the plugin, and the scope change (S:C) means impact falls on the agent node rather than the Jenkins controller. No public exploit code exists and SSVC rates exploitation status as none with non-automatable attack path, placing real-world priority lower than the raw CVSS score suggests.
OS command injection in Jenkins TICS Plugin 2025.1.1 and earlier allows an authenticated, low-privileged Jenkins user who can control build environment variable values to execute arbitrary commands on the build agent hosting the job. The flaw stems from unsanitized environment variable values being passed directly to OS command invocations within the plugin, and the scope change (S:C) means impact falls on the agent node rather than the Jenkins controller. No public exploit code exists and SSVC rates exploitation status as none with non-automatable attack path, placing real-world priority lower than the raw CVSS score suggests.