Script Security (Jenkins) - vulnerabilities (CVEs)

45 CVEs, 0 in the last 30 days, 136 known versions, newest CVE from 2026-09-16. Vendor: Jenkins.

CVEs of Script Security

CVE-2026-92129 - CVSS 7.5 (high), 2026-09-16: Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at…
CVE-2026-92128 - CVSS 7.5 (high), 2026-09-16: Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download…
CVE-2026-92127 - CVSS 8 (high), 2026-09-16: Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with…
CVE-2026-92126 - CVSS 8.5 (high), 2026-09-16: Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class,…
CVE-2026-92125 - CVSS 8.8 (high), 2026-09-16: Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with…
CVE-2026-92124 - CVSS 8.8 (high), 2026-09-16: Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from a collection that a…
CVE-2026-92123 - CVSS 8.8 (high), 2026-09-16: Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null receiver (method calls, property and…
CVE-2026-92122 - CVSS 8.8 (high), 2026-09-16: Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a…
CVE-2026-84658 - CVSS 4.3 (medium), 2026-09-02: Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads script approval…
CVE-2026-84659 - CVSS 4.3 (medium), 2026-09-02: Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the…
CVE-2026-57281 - CVSS 8.5 (high), 2026-06-24: Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing…
CVE-2026-57280 - CVSS 8.8 (high), 2026-06-24: Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in…
CVE-2026-42519 - CVSS 4.3 (medium), 2026-04-29: A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate…
CVE-2024-52549 - CVSS 4.3 (medium), 2024-11-13: Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission…
CVE-2024-34145 - CVSS 8.8 (high), 2024-05-02: A sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined classes in Jenkins Script Security Plugin…
CVE-2024-34144 - CVSS 9.8 (critical), 2024-05-02: A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with…
CVE-2023-24422 - CVSS 8.8 (high), 2023-01-26: A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission…
CVE-2022-45379 - CVSS 7.5 (high), 2022-11-15: Jenkins Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as the SHA-1 hash of the script, making it vulnerable to…
CVE-2022-43403 - CVSS 9.9 (critical), 2022-10-19: A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier…
CVE-2022-43401 - CVSS 9.9 (critical), 2022-10-19: A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin…
CVE-2022-43404 - CVSS 9.9 (critical), 2022-10-19: A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic constructors in Jenkins Script Security Plugin…
CVE-2022-30946 - CVSS 4.3 (medium), 2022-05-17: A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to have Jenkins send an…
CVE-2020-2279 - CVSS 9.9 (critical), 2020-09-23: A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed scripts to provide…
CVE-2020-2190 - CVSS 5.4 (medium), 2020-06-03: Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page,…
CVE-2020-2134 - CVSS 8.8 (high), 2020-03-09: Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted constructor calls and crafted constructor bodies.
CVE-2020-2135 - CVSS 8.8 (high), 2020-03-09: Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted method calls on objects that implement…
CVE-2020-2110 - CVSS 8.8 (high), 2020-02-12: Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming…
CVE-2019-16538 - CVSS 8.8 (high), 2019-11-21: A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed…
CVE-2019-10431 - CVSS 9.9 (critical), 2019-10-01: A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors…
CVE-2019-10393 - CVSS 4.2 (medium), 2019-09-12: A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of method names in method call expressions allowed…
CVE-2019-10400 - CVSS 4.2 (medium), 2019-09-12: A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of subexpressions in increment and decrement…
CVE-2019-10399 - CVSS 4.2 (medium), 2019-09-12: A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions in…
CVE-2019-10394 - CVSS 4.2 (medium), 2019-09-12: A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions on the…
CVE-2019-10356 - CVSS 8.8 (high), 2019-07-31: A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions allowed attackers to…
CVE-2019-10355 - CVSS 8.8 (high), 2019-07-31: A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to execute arbitrary…
CVE-2019-1003040 - CVSS 9.8 (critical), 2019-03-28: A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.
CVE-2019-1003029 - CVSS 9.9 (critical), 2019-03-08: A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in…
CVE-2019-1003024 - CVSS 8.8 (high), 2019-02-20: A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows attackers with…
CVE-2019-1003005 - CVSS 8.8 (high), 2019-02-06: A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in…
CVE-2019-1003000 - CVSS 8.8 (high), 2019-01-22: A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in…
CVE-2018-1000865 - CVSS 8.8 (high), 2018-12-10: A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in…
CVE-2017-1000505 - CVSS 6.5 (medium), 2018-01-25: In Jenkins Script Security Plugin version 1.36 and earlier, users with the ability to configure sandboxed Groovy scripts are able to use a type coercion…
CVE-2017-1000107 - CVSS 8.8 (high), 2017-10-05: Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor invocations, method…
CVE-2017-1000095 - CVSS 6.5 (medium), 2017-10-05: The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(Object, String).…
CVE-2016-3102 - CVSS 7.3 (high), 2017-02-09: The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugin that performs…