GHSA-4m7p-55jm-3vwv
GitHub Security Advisory
Improper Neutralization of Special Elements used in an OS Command in Jenkins Pipeline: Groovy Plugin
✓ GitHub Reviewed
HIGH
Has CVE
Advisory Details
Jenkins Pipeline: Groovy Plugin prior to 2656.vf7a_e7b_75a_457, 2.94.1, and 2.92.1 uses the same checkout directories for distinct SCMs when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Affected Packages
Maven
org.jenkins-ci.plugins.workflow:workflow-cps
Affected versions:
2646.v6ed3b5b01ff1
(fixed in 2656.vf7a)
Maven
org.jenkins-ci.plugins.workflow:workflow-cps
Affected versions:
2.93
(fixed in 2.94.1)
Maven
org.jenkins-ci.plugins.workflow:workflow-cps
Affected versions:
0
(fixed in 2.92.1)
Related CVEs
Key Information
7.5
/10
Dataset
Last updated: July 2, 2025 6:26 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.