Critical Alert 1 Active Exploit Detected Today

CVE-2026-63077 — JetBrains TeamCity Deserialization of Untrusted Data Vulnerability →
Powered by CVE Watchtower
×
August 6, 2026

CVE Watchtower


← Back to CVE List

CVE-2025-67640NVD

Vulnerability Summary

Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands.
Severity Level
MEDIUM(5.0)
Published Date
Dec 10, 2025
Last Modified
Dec 17, 2025
Exploitation Status
No confirmed exploitation yet
EPSS Score (30-Day)
Data Pending
Root Weakness (CWE)
CWE-78: OS Command Injection ↗
The software constructs all or part of an OS command using externally-influenced input, but does not properly neutralize special elements.
CVSS v3.1 Base Metrics
Attack VectorNetwork
Attack ComplexityHigh
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityLow
IntegrityLow
AvailabilityLow

External References