Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
jenkinsci/git-client-plugin
master @ 7bd3083
9
Fixes
0
CVEs
HIGH
Peak severity
25.0%
Coverage
Highlights
Command Injection: 3 prior fixes. Scrutinize any change in this area.
src/main/java/org/jenkinsci/plugins/gitclient/CliGitAPIImpl.java: most-fixed (5 issues). Treat as high-risk during review.
5 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: The plugin dynamically generates wrapper scripts and shell commands to invoke native git. Insufficiently escaped credentials and unvalidated repository URLs have led to multiple command injection vulnerabilities under both Windows and POSIX-like environments.
Information Disclosure: Sensitive credentials, passphrases, and SSH keys used for git operations have been leaked through default workspace-local permissions and unmasked error/execution logs.
Arbitrary File Write: Generating temporary wrappers inside the workspace directory left the plugin vulnerable to path hijacking and argument manipulation, requiring forced isolation within the system temp directory.