CVE-2022-41237: Jenkins Dotci

Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days.

Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.

Affected products

• Jenkins Dotci: up to and including 2.40.00

Published 2022-09-21. Last modified 2026-06-17.