GHSA-h5mv-fv98-gqmq
GitHub Security Advisory
OS command injection vulnerability in Jenkins Play Framework Plugin
✓ GitHub Reviewed
HIGH
Has CVE
Advisory Details
A form validation endpoint in Play Framework Plugin executes the `play` command to validate a given input file.
Play Framework Plugin 1.0.2 and earlier lets users specify the path to the `play` command on the Jenkins controller. This results in an OS command injection vulnerability exploitable by users able to store such a file on the Jenkins controller (e.g. through archiving artifacts).
Affected Packages
Maven
org.jenkins-ci.plugins:play-autotest-plugin
Affected versions:
0
(last affected: 1.0.2)
Related CVEs
Key Information
7.5
/10
Dataset
Last updated: August 27, 2025 6:31 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.