Git Client
Vendor:
First CVE: Nov 1, 2017 · Active for 8 years
6
Total CVEs
More Total CVEs than 80% of tracked products
1.2
Avg CVEs / Year
Higher CVE frequency than 55% of tracked products
5.8
Avg CVSS
Higher Avg CVSS than 17% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Git Client over time
Volume of CVEsAvg CVSS Base Score
First CVE
Nov 1, 2017
8 years ago
Most Recent CVE
Jun 24, 2026
29 days ago
CVE Severity & Scoring
Git Client6 CVEs
17%
50%
33%
All CVEs352,101 CVEs
45%
40%
11%
LowMediumHigh
Attack Vector
Local1 (16.7%)
Network5 (83.3%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low3 (50.0%)
High3 (50.0%)
Unknown0 (0.0%)
User Interaction
None6 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low5 (83.3%)
High0 (0.0%)
None1 (16.7%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-10392HIGH Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command inject | Sep 12, 2019 | 8.8 | 41 | NO | NO |
CVE-2026-57282MEDIUM Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded into a generated SSH wrapper script, allowing attackers able | Jun 24, 2026 | 5.0 | 25 | NO | NO |
CVE-2022-36881HIGH Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks. | Jul 27, 2022 | 8.1 | 20 | NO | NO |
CVE-2025-67640MEDIUM Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the pl | Dec 10, 2025 | 5.0 | 19 | NO | NO |
CVE-2025-58458MEDIUM In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the specified file path exists on the contro | Sep 3, 2025 | 4.3 | 17 | NO | NO |
Jenkins Git Client Plugin 2.4.2 and earlier creates temporary file with insecure permissions resulting in information disclosure | Nov 1, 2017 | 3.3 | 16 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (6 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (6 CVEs).
Media Mentions
Signals from CVEs in this product scope (6 CVEs).
Top CNAs Publishing CVEs For Git Client
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 6.2.0 | 1 | 4.3 | 0.3% | 0 | 0 |
| 3.0.0 | 1 | 8.8 | 25.8% | 0 | 0 |