CVE-2025-67640: OS Command Injection
Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.jenkins-ci.plugins:git-clientto a version that resolves this vulnerability.Fixed in 6.4.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67640?
CVE-2025-67640 has a moderate severity rating due to its potential for arbitrary OS command injection.
How do I fix CVE-2025-67640?
To fix CVE-2025-67640, update the Jenkins Git client Plugin to version 6.5.0 or later.
Who is affected by CVE-2025-67640?
CVE-2025-67640 affects users of the Jenkins Git client Plugin version 6.4.0 and earlier.
What types of attacks can exploit CVE-2025-67640?
CVE-2025-67640 can be exploited by attackers who can control the workspace directory name to execute arbitrary OS commands.
When was CVE-2025-67640 disclosed?
CVE-2025-67640 was disclosed as part of a security advisory on December 10, 2025.