-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from incorrect execution context handling when setting up build log annotations. The advisory specifically mentions improper API calls on agents that should only run on controllers. The primary suspect is the Gradle execution method (invoke/run) that handles build process orchestration. These functions would show in runtime profiles when attempting to mask credentials during Gradle builds. The high confidence in GradleInvoker.invoke comes from its direct role in build execution flow, while GradleStep.Execution.run is medium confidence as the entry point that might propagate the flawed control flow.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:gradle | maven | <= 2.8 | 2.8.1 |
JavaJavaOngoing coverage of React2Shell