GHSA-m248-72rh-cpx4

Jenkins Dead Man's Snitch Plugin vulnerability does not mask tokens

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-53667

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:deadmanssnitch	<= 0.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Dead Man's Snitch Plugin 0.1 does not mask Dead Man's Snitch tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-53667 advisory
https://github.com/jenkinsci/deadmanssnitch-plugin package
https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3524 web
http://www.openwall.com/lists/oss-security/2025/07/09/4 web