Jenkins Project Jenkins Script Security Plugin
39 CVEs affecting Jenkins Project Jenkins Script Security Plugin. Latest disclosed: 2026-09-16. Critical: 8, High: 21.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-43404 | Critical | 9.9 | 2022-10-19 | A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic constructors in Jenkins Script Security Plugin 118… |
CVE-2022-43403 | Critical | 9.9 | 2022-10-19 | A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allo… |
CVE-2022-43401 | Critical | 9.9 | 2022-10-19 | A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin 1183.v774b_0b_0a_a… |
CVE-2020-2279 | Critical | 9.9 | 2020-09-23 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed scripts to provide craft… |
CVE-2019-10431 | Critical | 9.9 | 2019-10-01 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors allo… |
CVE-2019-1003029 | Critical | 9.9 | 2019-03-08 | A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/G… |
CVE-2024-34144 | Critical | 9.8 | 2024-05-02 | A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with per… |
CVE-2019-1003040 | Critical | 9.8 | 2019-03-28 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts. |
CVE-2026-92125 | High | 8.8 | 2026-09-16 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permissi… |
CVE-2026-92124 | High | 8.8 | 2026-09-16 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from a collection that a… |
CVE-2026-92123 | High | 8.8 | 2026-09-16 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null receiver (method calls, property and attribu… |
CVE-2026-92122 | High | 8.8 | 2026-09-16 | Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a v… |
CVE-2026-57280 | High | 8.8 | 2026-06-24 | Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in san… |
CVE-2024-34145 | High | 8.8 | 2024-05-02 | A sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined classes in Jenkins Script Security Plugin 1335.vf07d9… |
CVE-2023-24422 | High | 8.8 | 2023-01-26 | A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission t… |
CVE-2020-2135 | High | 8.8 | 2020-03-09 | Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted method calls on objects that implement GroovyInterc… |
CVE-2020-2134 | High | 8.8 | 2020-03-09 | Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted constructor calls and crafted constructor bodies. |
CVE-2020-2110 | High | 8.8 | 2020-02-12 | Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming an… |
CVE-2019-16538 | High | 8.8 | 2019-11-21 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed… |
CVE-2019-10356 | High | 8.8 | 2019-07-31 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions allowed attackers to ex… |