OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build.
https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3987