Jenkins · Matrix Project Plugin
CVE-2019-1003030
Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
What it is
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
CISA: Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: April 15, 2022
More exploited flaws from Jenkins
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 2, 2025 | Remote Code Execution | Jenkins | Critical 9.8 | 99.7% |
| Aug 19, 2024 | Command Line Interface (CLI) Path Traversal | Jenkins Command Line Interface (CLI) | Critical 9.8 | >99.9% |
| May 12, 2023 | User Interface (UI) Information Disclosure | Jenkins User Interface (UI) | High 7.5 | 23% |
| Apr 25, 2022 | Sandbox Bypass | Script Security Plugin | Critical 9.9 | 74% |
| Feb 10, 2022 | Stapler Web Framework Deserialization of Untrusted Data | Jenkins Stapler Web Framework | Critical 9.8 | 98% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.