CVE-2025-53652

Vulnerability

Overview

The Jenkins Git Parameter Plugin, versions 439.vb_0e46ca_14534 and earlier, implements a choice build parameter that lists Git branches, tags, or revisions from the configured SCM. However, the plugin does not validate that the value submitted to the build matches one of the offered choices [1][4]. This missing input validation allows an attacker to bypass the intended selection mechanism.

Exploitation

Prerequisites

An attacker must have Item/Build permission on a Jenkins job that uses the Git Parameter Plugin. No additional authentication or network position is required beyond standard Jenkins access. The attacker can submit an arbitrary string as the Git parameter value, which the plugin accepts without verifying it against the predefined list [1][2].

Impact

By injecting an arbitrary Git parameter value, an attacker can influence the build process in ways not intended by the job configuration. Depending on how the parameter is used in the build (e.g., to checkout a repository, run scripts, or pass to other tools), this could lead to unauthorized code execution, information disclosure, or other security breaches. The Jenkins Security Advisory rates this vulnerability as Medium severity [1].

Mitigation

The vulnerability is fixed in Git Parameter Plugin version 444.vca_b_84d3703c2 [1][2]. Users should upgrade to this version or later. No workaround is documented; upgrading is the recommended action.