Command Injection Affecting org.jenkins-ci.plugins:git-client package, versions [,6.6.1)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-ORGJENKINSCIPLUGINS-17458838
- published25 Jun 2026
- disclosed25 Jun 2026
- creditRavindu Wickramasinghe
Introduced: 25 Jun 2026
CVE-2026-57282 (opens in a new tab)How to fix?
Upgrade org.jenkins-ci.plugins:git-client to version 6.6.1 or higher.
Overview
org.jenkins-ci.plugins:git-client is a Jenkins git client plugin.
Affected versions of this package are vulnerable to Command Injection via improper neutralization of workspace directory names in the SSH wrapper script generated by the "Manually provided keys" Git Host Key Verification strategy. An attacker can execute arbitrary commands on a Unix agent by controlling the workspace directory name and embedding shell command substitution sequences. Because the workspace path is incorporated into the generated SSH wrapper script without proper escaping, attacker-controlled content may be interpreted and executed by the shell.
Note: This is only exploitable when an attacker can control the build working directory (for example, through the argument to the dir(...) Pipeline step) but cannot otherwise control the Pipeline definition or executed build scripts.