Live › vulnerability › CVE-2019-1003029
Go to dashboardThe Jenkins Script Security Plugin has a sandbox bypass that lets a user run code outside the sandbox that is meant to contain Groovy scripts. An attacker who can submit scripts to Jenkins can run arbitrary code on the Jenkins controller.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Jenkins Script Security Plugin | vendor | – | – |
Check the installed version of the Script Security plugin in Manage Jenkins > Plugins > Installed; unknown for the exact affected range from these sources.
Update the Script Security Plugin to the fixed version per Jenkins security advisory; unknown exact fixed version from these sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
This page as .md · .json · in your agent: get_signal("CVE-2019-1003029")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.