Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.jenkins-ci.plugins.workflow:workflow-cps

13 known vulnerabilities (1 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release
4403.v471713a_cea_19 (Nov 2, 2026): no advisory with comparable ranges affects it; 4 advisories (CVE-2024-52550, CVE-2022-43404, CVE-2022-43402, …) can't be checked against versions
Newest unaffected release
4403.v471713a_cea_19 (Nov 2, 2026), the latest release, not counting 4 advisories without comparable ranges
Advisories
13 · 1 critical, 1 high
Dependents
3
Releases
321 since 1.0 (Feb 13, 2024)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2024-52550
    Its ranges can't be placed on these versions
    Its ranges can't be placed on these versions
  • CVE-2022-43404
    Its ranges can't be placed on these versions
    Its ranges can't be placed on these versions
  • CVE-2022-43402
    Its ranges can't be placed on these versions
    Its ranges can't be placed on these versions
  • CVE-2022-43401
    Its ranges can't be placed on these versions
    Its ranges can't be placed on these versions
  • CVE-2022-30945
    Affects 0.1-beta-1 to 2689.v434009a_31b_f1 (2692.v76b_089ccd026 is outside it)
  • CVE-2022-25180
    Affects 0.1-beta-1 to 2648.2651.v230593e03e9f (2656.vf7a_e7b_75a_457 is outside it)
  • CVE-2022-25176
    Affects 0.1-beta-1 to 2.92 (2.92.1 is outside it); 2.93 to 2.94 (2.94.1 is outside it); 2633.v6baeedc13805 to 2648.va9433432b33c (2648.2651.v230593e03e9f is outside it)
  • CVE-2022-25173
    Affects 0.1-beta-1 to 2.92 (2.92.1 is outside it); 2.93 to 2.94 (2.94.1 is outside it); 2646.v6ed3b5b01ff1 to 2648.2651.v230593e03e9f (2656.vf7a_e7b_75a_457 is outside it)
  • CVE-2020-2109
    Affects 0.1-beta-1 to 2.78 (2.79 is outside it)
  • CVE-2019-1003041
    Affects 0.1-beta-1 to 2.64 (2.65 is outside it)
  • CVE-2019-1003030
    Affects 0.1-beta-1 to 2.63 (2.64 is outside it)
  • CVE-2018-1000866
    Affects 0.1-beta-1 to 2.59 (2.60 is outside it)
  • CVE-2017-1000096
    Affects 0.1-beta-1 to 2.36 (2.36.1 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 13

  • Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main…

    Affected: fixed in 3993.v3e20a.

  • A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic constructors in Jenkins…

    Affected: fixed in 2803.v1a_f77ffcc773.

  • A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy…

    Affected: fixed in 2803.v1a_f77ffcc773.

  • A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security…

    Affected: fixed in 2803.v1a_f77ffcc773.

  • Jenkins Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier allows loading any Groovy source files on the classpath of Jenkins and…

    Affected: fixed in 2692.v76b.

    Fixed in 2692.v76b_089ccd026 (released Feb 13, 2024, 637 days after disclosure, the advisory names 2692.v76b, which was never published).

    The latest release, 4403.v471713a_cea_19, is not affected.

  • Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds…

    Affected: fixed in 2656.vf7a_e7b_75a_457.

    Fixed in 2656.vf7a_e7b_75a_457 (released Feb 13, 2024, 728 days after disclosure).

    The latest release, 4403.v471713a_cea_19, is not affected.

  • Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for…

    Affected: from 2.93, fixed in 2.94.1; fixed in 2.92.1; from 2.95, fixed in 2648.2651.v230593e03e9f.

    Fixed in 2.92.1 (released Feb 13, 2024, 728 days after disclosure), 2.94.1 (released Feb 13, 2024, 728 days after disclosure) and 2648.2651.v230593e03e9f (released Feb 13, 2024, 728 days after disclosure).

    The latest release, 4403.v471713a_cea_19, is not affected.

  • Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the…

    Affected: from 2646.v6ed3b5b01ff1, fixed in 2656.vf7a; from 2.93, fixed in 2.94.1; fixed in 2.92.1.

    Fixed in 2.92.1 (released Feb 13, 2024, 728 days after disclosure), 2.94.1 (released Feb 13, 2024, 728 days after disclosure) and 2656.vf7a_e7b_75a_457 (released Feb 13, 2024, 728 days after disclosure, the advisory names 2656.vf7a, which was never published).

    The latest release, 4403.v471713a_cea_19, is not affected.

  • Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in…

    Affected: fixed in 2.79.

    Fixed in 2.79 (released Feb 13, 2024, 1462 days after disclosure).

    The latest release, 4403.v471713a_cea_19, is not affected.

  • A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in…

    Affected: fixed in 2.65.

    Fixed in 2.65 (released Feb 13, 2024, 1783 days after disclosure).

    The latest release, 4403.v471713a_cea_19, is not affected.

  • CVE-2019-1003030Critical 9.9 · KEV

    A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/wo

    Affected: fixed in 2.64.

    Fixed in 2.64 (released Feb 13, 2024, 1803 days after disclosure).

    The latest release, 4403.v471713a_cea_19, is not affected.

  • A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in…

    Affected: fixed in 2.60.

    Fixed in 2.60 (released Feb 13, 2024, 1891 days after disclosure).

    The latest release, 4403.v471713a_cea_19, is not affected.

  • Arbitrary code execution due to incomplete sandbox protection: Constructors, instance variable initializers, and instance initializers in…

    Affected: fixed in 2.36.1.

    Fixed in 2.36.1 (released Feb 13, 2024, 2323 days after disclosure).

    The latest release, 4403.v471713a_cea_19, is not affected.