VulnerableCode Package Details - pkg:maven/org.jenkins-ci.plugins.workflow/workflow-cps@2.92.1

Search for packages

Vulnerability	Summary	Fixed by
This package is not known to be affected by vulnerabilities.

Vulnerability

Summary

Fixed by

This package is not known to be affected by vulnerabilities.

Vulnerability	Summary	Aliases
VCID-jj9c-e7k7-aqea	Improper Link Resolution Before File Access ('Link Following') Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers able to configure Pipelines to read arbitrary files on the Jenkins controller file system.	CVE-2022-25176 GHSA-6473-gqrj-4p65
VCID-x5nw-w14p-juas	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.	CVE-2022-25173 GHSA-4m7p-55jm-3vwv

Vulnerability

Summary

Aliases

VCID-jj9c-e7k7-aqea

Improper Link Resolution Before File Access ('Link Following') Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers able to configure Pipelines to read arbitrary files on the Jenkins controller file system.

CVE-2022-25176
GHSA-6473-gqrj-4p65

VCID-x5nw-w14p-juas

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.

CVE-2022-25173
GHSA-4m7p-55jm-3vwv

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T15:59:56.523474+00:00	GHSA Importer	Fixing	VCID-x5nw-w14p-juas	https://github.com/advisories/GHSA-4m7p-55jm-3vwv	38.0.0
2026-04-01T15:59:56.239767+00:00	GHSA Importer	Fixing	VCID-jj9c-e7k7-aqea	https://github.com/advisories/GHSA-6473-gqrj-4p65	38.0.0
2026-04-01T13:06:20.567289+00:00	GithubOSV Importer	Fixing	VCID-jj9c-e7k7-aqea	https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-6473-gqrj-4p65/GHSA-6473-gqrj-4p65.json	38.0.0
2026-04-01T13:06:15.638169+00:00	GithubOSV Importer	Fixing	VCID-x5nw-w14p-juas	https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-4m7p-55jm-3vwv/GHSA-4m7p-55jm-3vwv.json	38.0.0