GHSA-jq84-6fmm-6qv6
GitHub Security Advisory
OS command execution vulnerability in Perfecto Plugin
✓ GitHub Reviewed
HIGH
Has CVE
Advisory Details
Perfecto Plugin allows specifying Perfecto Connect Path and Perfecto Connect File Name in job configurations.
This command is executed on the Jenkins controller in Perfecto Plugin 1.17 and earlier, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controller.
Perfecto Plugin 1.18 executes the specified commands on the agent the build is running on.
Affected Packages
Maven
io.jenkins.plugins:perfecto
Affected versions:
0
(fixed in 1.18)
Related CVEs
Key Information
7.5
/10
Dataset
Last updated: August 25, 2025 6:33 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.