OS command injection in Jenkins Selection tasks Plugin
Priority MEDIUM 41CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-78.
Summary
Jenkins Selection tasks Plugin 1.0 and earlier executes a user-specified program on the Jenkins controller, allowing attackers with Job/Configure permission to execute an arbitrary system command on the Jenkins controller as the OS user that the Jenkins process is running as.
Why it matters now
EPSS 0.01623 76th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Jenkins | Jenkins Selection tasks Plugin | up to 1.0 | — | No fix listed | CNA |
| — | org.jvnet.hudson.plugins:selection-tasks-plugin (Maven) | up to 1.0 | — | No fix listed | GHSA-79h8-7735-v3f9 |
- Jenkins Selection tasks Plugin VendorJenkins Affected up to 1.0 Fixed in — No fix listed CNA
- org.jvnet.hudson.plugins:selection-tasks-plugin (Maven) Vendor— Affected up to 1.0 Fixed in — No fix listed GHSA-79h8-7735-v3f9
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-2276
- 2026-10-03 Alias added: GHSA-79h8-7735-v3f9
References
More Jenkins Selection Tasks vulnerabilities
- TI-2022-13023 Cross-site scripting in Jenkins Selection tasks Plugin CVSS 3.1MEDIUM 5.4
Sources
- CVE-2020-2276 · CVE Program
- CVE-2020-2276 · NVD
- FIRST EPSS
- GHSA-79h8-7735-v3f9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences