High · 7.4 CVE-2026-84675 EUVD-2026-70148GHSA-2g8p-r374-fc4m

OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable …

Published Sep 2, 2026 · Updated Sep 2, 2026 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins TICS Plugin Category: Web / CMS

Description

OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build.

Affected products

Vendor	Product	Affected	Fixed
Jenkins Project	Jenkins TICS Plugin	≤ 2025.1.1	—

Advisories 1

WID-SEC-2026-3166 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 21, 2026

References

Jenkins Security Advisory 2026-09-02 vendor-advisory