Jenkins Script Security Plugin
Monthly
Sandbox escape in Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier allows an authenticated Jenkins user who is permitted to define and run sandboxed scripts - including Pipeline jobs - to break out of the Groovy sandbox and execute arbitrary code on the Jenkins controller. The flaw is a protection-mechanism failure (CWE-693): the sandbox's call-site interception does not cover methods that are added dynamically to a class at runtime, so a crafted script can invoke such a method and run code that should have been blocked. Exploitation requires script-authoring privileges (PR:L) and a deliberately crafted script (AC:H) with no user interaction, giving high confidentiality, integrity, and availability impact on the controller; no public exploit code was identified at the time of analysis, and the practical risk is concentrated in multi-tenant Jenkins deployments where lower-trust users are delegated Pipeline authoring.
Arbitrary code execution in the Jenkins Script Security Plugin (versions up to and including 1415.v9a_f9b_3a_c253d) lets an authenticated attacker who holds permission to define classpath entries run attacker-supplied code inside the Jenkins controller JVM. The plugin downloads the URL-specified JAR twice - it verifies approval against the first response but then loads classpath entries from the second - so an attacker who controls the hosting server can present a benign, approvable JAR on request one and a malicious JAR on request two. The assessed CVSS 3.1 vector (7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects this time-of-check/time-of-use race: the flaw is remotely reachable but requires an authenticated classpath-defining user and a reliably won race; there is no public exploit code and no confirmed active exploitation identified at time of analysis.
Arbitrary code execution in Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier: when a user with job-configure privileges defines classpath entries in an item configuration, those entries are silently auto-approved the moment a user holding Overall/Administer permission copies that item or updates its configuration through the REST API or CLI. The result is code execution inside the Jenkins controller JVM (CWE-94, CVSS 8.0), but exploitation is a two-actor, confused-deputy scenario: the attacker needs pre-existing config-edit rights (PR:L) and must wait for a privileged user to perform the copy or API/CLI update (UI:R), so installations where only administrators author jobs and never copy them or drive configuration through REST/CLI are effectively unexposed. No public exploit code or confirmed active exploitation was identified at time of analysis.
Sandbox escape in the Jenkins Script Security Plugin (1415.v9a_f9b_3a_c253d and earlier) allows an authenticated Jenkins user who holds permission to define and run sandboxed scripts - including Pipelines - to execute code outside the Groovy sandbox by supplying an @Builder annotation whose builderStrategy member names an arbitrary class. Exploitation additionally requires that a suitable "gadget" class be present on the classpath of the component that evaluates the script, which is why the assessment rates it AC:H despite high C:H/I:H/A:H impact and a scope change (S:C) across the sandbox boundary; the limitation is that only instances where untrusted or low-privilege users can author sandboxed scripts are meaningfully exposed. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.20% (11th percentile), consistent with a high-severity but precondition-heavy flaw rather than a mass-exploitable internet threat.
Sandbox escape leading to arbitrary code execution inside the Jenkins controller JVM affects Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier because the plugin fails to reject the @GroovyASTTransformationClass annotation in script source. An authenticated Jenkins user with permission to define and run sandboxed scripts, including Pipelines (the CVSS vector carries PR:L), can submit a script that registers a Groovy AST transformation executed at compile time, before the sandbox applies, resulting in high confidentiality, integrity, and availability impact on the controller; our independent assessment scores this 8.8 with a scope change (S:C) rather than the provider's S:U. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, but for any account holding script-submission rights the exploit path is direct rather than theoretical, so the practical risk concentrates on instances that grant Job/Configure or equivalent Pipeline-authoring rights broadly. This is a genuine high-priority vulnerability, not CVSS inflation: the sandbox itself, not a misconfiguration, is the control being bypassed.
Arbitrary code execution in Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier allows an authenticated attacker with permission to define and run sandboxed Groovy scripts or Pipelines to bypass the sandbox and run code in the Jenkins controller JVM. The flaw is a protection mechanism failure (CWE-693) in how the plugin casts collections, and it carries CVSS 8.8 with PR:L; only users who can author sandboxed scripts or Pipelines can trigger it. No public exploit code was identified at time of analysis, and CISA SSVC rates exploitation as none, but this is high-priority for multi-tenant Jenkins because script-authoring rights are often broadly granted.
Sandbox escape in the Jenkins Script Security Plugin (1415.v9a_f9b_3a_c253d and earlier) allows authenticated users with permission to define and run sandboxed Groovy or Pipeline scripts to execute arbitrary code in the Jenkins controller JVM, because the sandbox fails to intercept method calls, property and attribute accesses, and array accesses made on a null receiver. No non-default configuration is required - the weakness is inherent to the default sandbox - and the flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-693), with CISA SSVC assessing total technical impact but no active exploitation and no public exploit identified at time of analysis. Real-world urgency is moderated by the access prerequisite: the attacker must already hold script-authoring rights, so exposure is concentrated in multi-tenant or delegated Jenkins instances where Pipeline authoring is granted to less-trusted users.
Sandbox escape in the Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier lets an authenticated user who holds permission to define and run sandboxed scripts - including Pipelines - execute arbitrary code in the Jenkins controller JVM, earning a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The root cause is a protection-mechanism failure (CWE-693): the sandbox proxy created when a script coerces a value to a Java interface skips the method check when the coerced value inherits a same-named method, so the interface proxy can be used to reach unchecked code. No public exploit code has been identified at time of analysis and CISA SSVC rates the issue non-automatable (Exploitation: none, Automatable: no, Technical Impact: total), so mass exploitation is not expected; the binding prerequisite is the authenticated script-authoring permission reflected by PR:L, which makes this a real but privilege-gated RCE-class risk.
Sandbox escape in Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier allows users permitted to run sandboxed Groovy scripts to execute arbitrary code outside the sandbox. The plugin fails to reject Groovy AST transformation annotations that carry an 'extensions' member, so an attacker can point that member at a suitable class already on the evaluating component's classpath and have it run outside sandbox restrictions. No public exploit identified at time of analysis, and SSVC exploitation status is 'none'; EPSS is low at 0.39%.
Sandbox bypass in the Jenkins Script Security Plugin (1402.v94c9ce464861 and earlier) lets users who can supply sandboxed Groovy scripts invoke arbitrary constructors, escaping the sandbox to run unrestricted code on the Jenkins controller. The flaw stems from the plugin failing to intercept implicit type casts on elements of typed for-each loops, a subtle gap in its interception logic. Reported by the Jenkins project (SECURITY-3792) with no public exploit identified at time of analysis; EPSS is low at 0.37% and CISA SSVC records no observed exploitation.
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier allows any low-privileged authenticated Jenkins user to disable the 'Force the use of the sandbox globally in the system' security control via a missing permission check exposed through Stapler data binding. The CVSS score of 4.3 reflects only the direct act of altering a setting, but the chained real-world risk is substantially higher: disabling global sandbox enforcement removes the primary defense against unrestricted Groovy execution, enabling subsequent RCE by any user with script authorship rights. No public exploit has been identified at time of analysis, and exploitation has not been confirmed by CISA KEV.
Improper use of the @DataBoundConstructor annotation in Jenkins Script Security Plugin versions ≤1412.v7737b_3405f86 enables low-privileged authenticated users to read the plugin's script approval configuration by submitting certain Jenkins forms. The flaw allows enumeration of which Groovy scripts, methods, and signatures have been approved for execution - information that could assist an attacker in mapping permitted scripted operations within the Jenkins environment. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at the time of analysis.
Jenkins Script Security Plugin versions up to and including 1399.ve6a_66547f6e1 expose classpath enumeration to any user holding the low-privilege Overall/Read permission due to a missing authorization check (CWE-862). Any authenticated Jenkins user can query pending and approved Script Security classpaths without elevated rights, leaking internal class names, library paths, and approved script configuration useful for targeted reconnaissance. No public exploit exists and EPSS sits at 0.03% (7th percentile), placing this firmly in the low-urgency tier despite its network-reachable vector.
Sandbox escape in Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier allows an authenticated Jenkins user who is permitted to define and run sandboxed scripts - including Pipeline jobs - to break out of the Groovy sandbox and execute arbitrary code on the Jenkins controller. The flaw is a protection-mechanism failure (CWE-693): the sandbox's call-site interception does not cover methods that are added dynamically to a class at runtime, so a crafted script can invoke such a method and run code that should have been blocked. Exploitation requires script-authoring privileges (PR:L) and a deliberately crafted script (AC:H) with no user interaction, giving high confidentiality, integrity, and availability impact on the controller; no public exploit code was identified at the time of analysis, and the practical risk is concentrated in multi-tenant Jenkins deployments where lower-trust users are delegated Pipeline authoring.
Arbitrary code execution in the Jenkins Script Security Plugin (versions up to and including 1415.v9a_f9b_3a_c253d) lets an authenticated attacker who holds permission to define classpath entries run attacker-supplied code inside the Jenkins controller JVM. The plugin downloads the URL-specified JAR twice - it verifies approval against the first response but then loads classpath entries from the second - so an attacker who controls the hosting server can present a benign, approvable JAR on request one and a malicious JAR on request two. The assessed CVSS 3.1 vector (7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects this time-of-check/time-of-use race: the flaw is remotely reachable but requires an authenticated classpath-defining user and a reliably won race; there is no public exploit code and no confirmed active exploitation identified at time of analysis.
Arbitrary code execution in Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier: when a user with job-configure privileges defines classpath entries in an item configuration, those entries are silently auto-approved the moment a user holding Overall/Administer permission copies that item or updates its configuration through the REST API or CLI. The result is code execution inside the Jenkins controller JVM (CWE-94, CVSS 8.0), but exploitation is a two-actor, confused-deputy scenario: the attacker needs pre-existing config-edit rights (PR:L) and must wait for a privileged user to perform the copy or API/CLI update (UI:R), so installations where only administrators author jobs and never copy them or drive configuration through REST/CLI are effectively unexposed. No public exploit code or confirmed active exploitation was identified at time of analysis.
Sandbox escape in the Jenkins Script Security Plugin (1415.v9a_f9b_3a_c253d and earlier) allows an authenticated Jenkins user who holds permission to define and run sandboxed scripts - including Pipelines - to execute code outside the Groovy sandbox by supplying an @Builder annotation whose builderStrategy member names an arbitrary class. Exploitation additionally requires that a suitable "gadget" class be present on the classpath of the component that evaluates the script, which is why the assessment rates it AC:H despite high C:H/I:H/A:H impact and a scope change (S:C) across the sandbox boundary; the limitation is that only instances where untrusted or low-privilege users can author sandboxed scripts are meaningfully exposed. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.20% (11th percentile), consistent with a high-severity but precondition-heavy flaw rather than a mass-exploitable internet threat.
Sandbox escape leading to arbitrary code execution inside the Jenkins controller JVM affects Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier because the plugin fails to reject the @GroovyASTTransformationClass annotation in script source. An authenticated Jenkins user with permission to define and run sandboxed scripts, including Pipelines (the CVSS vector carries PR:L), can submit a script that registers a Groovy AST transformation executed at compile time, before the sandbox applies, resulting in high confidentiality, integrity, and availability impact on the controller; our independent assessment scores this 8.8 with a scope change (S:C) rather than the provider's S:U. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, but for any account holding script-submission rights the exploit path is direct rather than theoretical, so the practical risk concentrates on instances that grant Job/Configure or equivalent Pipeline-authoring rights broadly. This is a genuine high-priority vulnerability, not CVSS inflation: the sandbox itself, not a misconfiguration, is the control being bypassed.
Arbitrary code execution in Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier allows an authenticated attacker with permission to define and run sandboxed Groovy scripts or Pipelines to bypass the sandbox and run code in the Jenkins controller JVM. The flaw is a protection mechanism failure (CWE-693) in how the plugin casts collections, and it carries CVSS 8.8 with PR:L; only users who can author sandboxed scripts or Pipelines can trigger it. No public exploit code was identified at time of analysis, and CISA SSVC rates exploitation as none, but this is high-priority for multi-tenant Jenkins because script-authoring rights are often broadly granted.
Sandbox escape in the Jenkins Script Security Plugin (1415.v9a_f9b_3a_c253d and earlier) allows authenticated users with permission to define and run sandboxed Groovy or Pipeline scripts to execute arbitrary code in the Jenkins controller JVM, because the sandbox fails to intercept method calls, property and attribute accesses, and array accesses made on a null receiver. No non-default configuration is required - the weakness is inherent to the default sandbox - and the flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-693), with CISA SSVC assessing total technical impact but no active exploitation and no public exploit identified at time of analysis. Real-world urgency is moderated by the access prerequisite: the attacker must already hold script-authoring rights, so exposure is concentrated in multi-tenant or delegated Jenkins instances where Pipeline authoring is granted to less-trusted users.
Sandbox escape in the Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier lets an authenticated user who holds permission to define and run sandboxed scripts - including Pipelines - execute arbitrary code in the Jenkins controller JVM, earning a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The root cause is a protection-mechanism failure (CWE-693): the sandbox proxy created when a script coerces a value to a Java interface skips the method check when the coerced value inherits a same-named method, so the interface proxy can be used to reach unchecked code. No public exploit code has been identified at time of analysis and CISA SSVC rates the issue non-automatable (Exploitation: none, Automatable: no, Technical Impact: total), so mass exploitation is not expected; the binding prerequisite is the authenticated script-authoring permission reflected by PR:L, which makes this a real but privilege-gated RCE-class risk.
Sandbox escape in Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier allows users permitted to run sandboxed Groovy scripts to execute arbitrary code outside the sandbox. The plugin fails to reject Groovy AST transformation annotations that carry an 'extensions' member, so an attacker can point that member at a suitable class already on the evaluating component's classpath and have it run outside sandbox restrictions. No public exploit identified at time of analysis, and SSVC exploitation status is 'none'; EPSS is low at 0.39%.
Sandbox bypass in the Jenkins Script Security Plugin (1402.v94c9ce464861 and earlier) lets users who can supply sandboxed Groovy scripts invoke arbitrary constructors, escaping the sandbox to run unrestricted code on the Jenkins controller. The flaw stems from the plugin failing to intercept implicit type casts on elements of typed for-each loops, a subtle gap in its interception logic. Reported by the Jenkins project (SECURITY-3792) with no public exploit identified at time of analysis; EPSS is low at 0.37% and CISA SSVC records no observed exploitation.
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier allows any low-privileged authenticated Jenkins user to disable the 'Force the use of the sandbox globally in the system' security control via a missing permission check exposed through Stapler data binding. The CVSS score of 4.3 reflects only the direct act of altering a setting, but the chained real-world risk is substantially higher: disabling global sandbox enforcement removes the primary defense against unrestricted Groovy execution, enabling subsequent RCE by any user with script authorship rights. No public exploit has been identified at time of analysis, and exploitation has not been confirmed by CISA KEV.
Improper use of the @DataBoundConstructor annotation in Jenkins Script Security Plugin versions ≤1412.v7737b_3405f86 enables low-privileged authenticated users to read the plugin's script approval configuration by submitting certain Jenkins forms. The flaw allows enumeration of which Groovy scripts, methods, and signatures have been approved for execution - information that could assist an attacker in mapping permitted scripted operations within the Jenkins environment. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at the time of analysis.
Jenkins Script Security Plugin versions up to and including 1399.ve6a_66547f6e1 expose classpath enumeration to any user holding the low-privilege Overall/Read permission due to a missing authorization check (CWE-862). Any authenticated Jenkins user can query pending and approved Script Security classpaths without elevated rights, leaking internal class names, library paths, and approved script configuration useful for targeted reconnaissance. No public exploit exists and EPSS sits at 0.03% (7th percentile), placing this firmly in the low-urgency tier despite its network-reachable vector.