Jenkins · Script Security Plugin
CVE-2019-1003029
Jenkins Script Security Plugin Sandbox Bypass Vulnerability
What it is
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
CISA: Jenkins Script Security Plugin contains a protection mechanism failure, allowing an attacker to bypass the sandbox.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 16, 2022
More exploited flaws from Jenkins
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 2, 2025 | Remote Code Execution | Jenkins | Critical 9.8 | 99.7% |
| Aug 19, 2024 | Command Line Interface (CLI) Path Traversal | Jenkins Command Line Interface (CLI) | Critical 9.8 | >99.9% |
| May 12, 2023 | User Interface (UI) Information Disclosure | Jenkins User Interface (UI) | High 7.5 | 23% |
| Mar 25, 2022 | Remote Code Execution | Matrix Project Plugin | Critical 9.9 | 97% |
| Feb 10, 2022 | Stapler Web Framework Deserialization of Untrusted Data | Jenkins Stapler Web Framework | Critical 9.8 | 98% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.