What is GHSA-v8hg-m323-jvjq?

GHSA-v8hg-m323-jvjq is a security advisory published by GitHub Security Advisories with Medium severity. Jenkins Git client Plugin has an OS command injection vulnerability on agents in Git client Plugin

Which CVE IDs does GHSA-v8hg-m323-jvjq cover?

GHSA-v8hg-m323-jvjq covers the following CVE IDs: CVE-2025-67640. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v8hg-m323-jvjq?

GHSA-v8hg-m323-jvjq has a CVSS v3 base score of 5.0, published by GitHub Security Advisories.

Which products are affected by GHSA-v8hg-m323-jvjq?

GHSA-v8hg-m323-jvjq affects 1 product, including: maven/org.jenkins-ci.plugins:git-client:\u003c 6.4.1.

GHSA-v8hg-m323-jvjqMediumCVSS 5.0

Jenkins Git client Plugin has an OS command injection vulnerability on agents in Git client Plugin

Vendor

GitHub Security Advisories

Published

December 10, 2025

Last Modified

December 10, 2025

🔗 CVE IDs covered (1)

CVE-2025-67640 →

📋 Description

Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands.

🎯 Affected products1

maven/org.jenkins-ci.plugins:git-client:< 6.4.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-67640
https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3614
https://github.com/jenkinsci/git-client-plugin/commit/5a271e5d1d08bd45cdb3c3541856d2dc2abf0dbc
https://github.com/advisories/GHSA-v8hg-m323-jvjq