CVE-2022-23118: Jenkins Debian Package Builder

High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days.

Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agents to invoke command-line `git` at an attacker-specified path on the controller, allowing attackers able to control agent processes to invoke arbitrary OS commands on the controller.

Affected products

• Jenkins Debian Package Builder: up to and including 1.6.11

Published 2022-01-12. Last modified 2026-06-17.