Is org.jenkins-ci.plugins:git safe ? org.jenkins-ci.plugins:git (maven) has 12 known vulnerabilities, the worst rated HIGH. Upgrade to 4.11.5 or later to clear all of them. No malicious-package signal is recorded.
// reach 0 direct dependencies
none carry a known advisory
0 packages depend on it
dependents not yet indexed for this ecosystem
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so maven packages are not covered.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 71st percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-84cm-vjwm-m979, the advisory selected below
// 12 advisories GHSA-84cm-vjwm-m979 Jenkins SCMs support a number of different URL schemes, including local file system paths (e.g. HIGH GHSA-rf5q-8gx3-xqfc Git Plugin connects to a user-specified Git repository as part of form validation. HIGH GHSA-jxmw-3gxf-fprh Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the Git Username and… MODE GHSA-8xwj-2wgh-gprh Git Plugin provides a webhook endpoint at /git/notifyCommit that can be used to notify Jenkins of changes to an SCM repository. MODE GHSA-449w-c77c-vmf6 Git Plugin provides a webhook endpoint at /git/notifyCommit that can be used to notify Jenkins of changes to an SCM repository. MODE GHSA-v878-67xw-grw2 Git Plugin provides a webhook endpoint at /git/notifyCommit that can be used to notify Jenkins of changes to an SCM repository. MODE GHSA-gghc-g8cj-4vfv Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause. MODE GHSA-6c7r-6p5m-cp82 Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resulting in a stored… MODE GHSA-r8rw-xx57-m64q A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.java that allows… MODE GHSA-53wf-vqf9-cgf2 A server-side request forgery vulnerability exists in Jenkins Git Plugin 3.9.0 and older in AssemblaWeb.java, GitBlitRepositoryBrowser.java, Gitiles.java… MODE GHSA-46p2-fwqg-3h6m An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and earlier in GitStatus.java that allows an attacker with network access to… MODE GHSA-8vfc-fcr2-47pj SCMs support a number of different URL schemes, including local file system paths (e.g. LOW Jenkins SCMs support a number of different URL schemes, including local file system paths (e.g.
Full advisory text at GitHub advisory or NVD .
// cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None // questions Is org.jenkins-ci.plugins:git safe to install? CyberXYZ does not call a package safe in absolute terms. It records 12 known vulnerabilities for org.jenkins-ci.plugins:git (maven), the worst rated HIGH, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does org.jenkins-ci.plugins:git have known vulnerabilities? Yes. CyberXYZ records 12 known vulnerabilities for org.jenkins-ci.plugins:git (maven), the worst rated HIGH. These include GHSA-84cm-vjwm-m979, GHSA-rf5q-8gx3-xqfc, GHSA-jxmw-3gxf-fprh, GHSA-8xwj-2wgh-gprh, GHSA-449w-c77c-vmf6.
Which version of org.jenkins-ci.plugins:git should I use? 4.11.5 or later clears every advisory recorded for org.jenkins-ci.plugins:git (maven). Check the release you pick before installing it.
How do I check org.jenkins-ci.plugins:git before installing? Search org.jenkins-ci.plugins:git in CyberXYZ Check at https://cyberxyz.io/check?q=org.jenkins-ci.plugins%3Agit . The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 10:29 UTC. The most recent advisory here was published 2022-08-24. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page