CVE-2026-84675

CVE-2026-84675 is an OS command injection flaw (CWE-78) in the Jenkins TICS Plugin, which integrates TIOBE's TICS code-quality analysis into Jenkins builds; all versions up to and including 2025.1.1 are affected. Attackers who are able to control build environment variable values — typically authenticated users with job-configuration rights or anyone supplying crafted build parameters — can inject and run arbitrary operating-system commands during the build. Successful exploitation yields command execution on the agent running the build, exposing that machine's files, source code, build artifacts, and potential lateral movement into CI infrastructure; the scope-changed CVSS base (7.4, high) reflects the impact to the impacted agent component. Any Jenkins instance running the TICS Plugin 2025.1.1 or earlier is affected, while no public proof-of-concept or in-the-wild exploitation is currently known, with a modest EPSS of about 1.2% (67th percentile) over the next 30 days.

What to do: Upgrade the TICS Plugin to a release later than 2025.1.1 as soon as it is available on your Jenkins controller. Until then, restrict Job/Configure permissions on affected Jenkins instances, audit jobs that pass user-controlled or parameterized values into environment variables consumed by TICS build steps, and check build agents for unexpected command or process executions.