Jenkins Script Security vulnerabilities

CVE-2018-1000865 [HIGH] CWE-269 CVE-2018-1000865: A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/s A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM, if plugins using the Groovy sandbox are installed.

CVE-2026-92127 [HIGH] CWE-94 CVE-2026-92127: Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpat Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates that configuration through the REST API or CLI, allowing attackers able to define classpath entries to execute arbitrary code in the context of

CVE-2019-16538 [HIGH] CWE-863 CVE-2019-16538: A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the han A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed attackers to execute arbitrary code in sandboxed scripts.

CVE-2026-57281 [HIGH] CWE-93 CVE-2026-57281: Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformat Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.

CVE-2026-92129 [HIGH] CWE-693 CVE-2026-92129: Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute code outside the sandbox.

CVE-2026-92128 [HIGH] CWE-494 CVE-2026-92128: Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by U Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the classpath entries from the second, allowing attackers able to define classpath entries to execute arbitrary code in the context of the Jenkins controller JVM.

CVE-2023-24422 [HIGH] CWE-78 CVE-2023-24422: A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd9 A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

CVE-2020-2110 [HIGH] CWE-20 CVE-2020-2110: Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during t Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.

CVE-2017-1000107 [HIGH] CVE-2017-1000107: Script Security Plugin did not apply sandboxing restrictions to constructor invocations via position Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor invocations, method references, and type coercion expressions. This could be used to invoke arbitrary constructors and methods, bypassing sandbox protection.

CVE-2020-2134 [HIGH] CWE-863 CVE-2020-2134: Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted constructor calls and crafted constructor bodies.

CVE-2020-2135 [HIGH] CWE-863 CVE-2020-2135: Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted method calls on objects that implement GroovyInterceptable.

CVE-2016-3102 [HIGH] CWE-254 CVE-2016-3102: The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugin that performs (1) direct field access or (2) get/set array operations.

CVE-2022-45379 [HIGH] CWE-326 CVE-2022-45379: Jenkins Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as th Jenkins Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as the SHA-1 hash of the script, making it vulnerable to collision attacks.

CVE-2017-1000505 [MEDIUM] CWE-200 CVE-2017-1000505: In Jenkins Script Security Plugin version 1.36 and earlier, users with the ability to configure sand In Jenkins Script Security Plugin version 1.36 and earlier, users with the ability to configure sandboxed Groovy scripts are able to use a type coercion feature in Groovy to create new `File` objects from strings. This allowed reading arbitrary files on the Jenkins master file system. Such a type coercion is now subject to sandbox protection and

CVE-2017-1000095 [MEDIUM] CWE-732 CVE-2017-1000095: The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, Stri The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(Object, String). These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild['rawBuild'] rather than currentBuild.rawBuild. Additionally, the foll

CVE-2019-10393 [MEDIUM] CVE-2019-10393: A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the han A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of method names in method call expressions allowed attackers to execute arbitrary code in sandboxed scripts.

CVE-2020-2190 [MEDIUM] CWE-79 CVE-2020-2190: Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classp Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulting in a stored cross-site scripting vulnerability.

CVE-2019-10399 [MEDIUM] CVE-2019-10399: A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the han A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions in increment and decrement expressions allowed attackers to execute arbitrary code in sandboxed scripts.

CVE-2019-10400 [MEDIUM] CVE-2019-10400: A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the han A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of subexpressions in increment and decrement expressions not involving actual assignment allowed attackers to execute arbitrary code in sandboxed scripts.

CVE-2019-10394 [MEDIUM] CVE-2019-10394: A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the han A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions on the left-hand side of assignment expressions allowed attackers to execute arbitrary code in sandboxed scripts.