5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-67640

CVE-2025-67640: Jenkins Git client Plugin has an OS command injection vulnerability on agents in Git client Plugin

Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-67640

CVE-2025-67640:

5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.jenkins-ci.plugins:git-client	maven	< 6.4.1	6.4.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2025-67640, is an OS command injection flaw in the Jenkins Git client Plugin. The root cause was the unsafe creation of temporary wrapper scripts for SSH authentication. The functions createWindowsGitSSH and createUnixGitSSH in CliGitAPIImpl.java would generate a .bat or .sh script, respectively, by directly embedding the file path to the SSH private key into the script's command line arguments.

The key's path is derived from the Jenkins workspace path, which can be controlled by an attacker with sufficient permissions. By creating a workspace with a name containing shell metacharacters, an attacker could inject commands into the generated script. For example, a workspace named my-job-touch /tmp/pwned`` on a Unix system would cause the touch command to be executed when the SSH wrapper script is run.

The patch mitigates this by fundamentally changing how the key path is passed to the script. Instead of insecure string concatenation, the path is now passed securely through an environment variable (JENKINS_GIT_SSH_KEYFILE). The wrapper scripts are modified to read this variable, preventing the shell from interpreting any special characters within the path. The createTempFile logic was also changed to always use a safe system temporary directory for these scripts, further hardening the fix.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.