# org.jenkins-ci.plugins.workflow:workflow-cps (Maven) vulnerabilities 13 known vulnerabilities (1 critical, 1 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4403.v471713a_cea_19 (Nov 2, 2026): no advisory with comparable ranges affects it; 4 advisories (CVE-2024-52550, CVE-2022-43404, CVE-2022-43402, …) can't be checked against versions - Newest unaffected release: 4403.v471713a_cea_19 (Nov 2, 2026), the latest release, not counting 4 advisories without comparable ranges - Dependents: 3 - Releases: 321 since 1.0 (Feb 13, 2024) - Registry: https://central.sonatype.com/artifact/org.jenkins-ci.plugins.workflow/workflow-cps - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2024-52550: its ranges can't be placed on these versions - CVE-2022-43404: its ranges can't be placed on these versions - CVE-2022-43402: its ranges can't be placed on these versions - CVE-2022-43401: its ranges can't be placed on these versions - CVE-2022-30945: 0.1-beta-1 to 2689.v434009a_31b_f1 (2692.v76b_089ccd026 is outside it) - CVE-2022-25180: 0.1-beta-1 to 2648.2651.v230593e03e9f (2656.vf7a_e7b_75a_457 is outside it) - CVE-2022-25176: 0.1-beta-1 to 2.92 (2.92.1 is outside it); 2.93 to 2.94 (2.94.1 is outside it); 2633.v6baeedc13805 to 2648.va9433432b33c (2648.2651.v230593e03e9f is outside it) - CVE-2022-25173: 0.1-beta-1 to 2.92 (2.92.1 is outside it); 2.93 to 2.94 (2.94.1 is outside it); 2646.v6ed3b5b01ff1 to 2648.2651.v230593e03e9f (2656.vf7a_e7b_75a_457 is outside it) - CVE-2020-2109: 0.1-beta-1 to 2.78 (2.79 is outside it) - CVE-2019-1003041: 0.1-beta-1 to 2.64 (2.65 is outside it) - CVE-2019-1003030: 0.1-beta-1 to 2.63 (2.64 is outside it) - CVE-2018-1000866: 0.1-beta-1 to 2.59 (2.60 is outside it) - CVE-2017-1000096: 0.1-beta-1 to 2.36 (2.36.1 is outside it) ## Advisories (13) ### [CVE-2024-52550](https://cve.now/CVE-2024-52550): Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a\_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main… - Severity: High 8.0 - Published: Nov 13, 2024 - Affected: fixed in 3993.v3e20a. ### [CVE-2022-43404](https://cve.now/CVE-2022-43404): A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic constructors in Jenkins… - Severity: Unrated - Published: Oct 19, 2022 - Affected: fixed in 2803.v1a_f77ffcc773. ### [CVE-2022-43402](https://cve.now/CVE-2022-43402): A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy… - Severity: Unrated - Published: Oct 19, 2022 - Affected: fixed in 2803.v1a_f77ffcc773. ### [CVE-2022-43401](https://cve.now/CVE-2022-43401): A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security… - Severity: Unrated - Published: Oct 19, 2022 - Affected: fixed in 2803.v1a_f77ffcc773. ### [CVE-2022-30945](https://cve.now/CVE-2022-30945): Jenkins Pipeline: Groovy Plugin 2689.v434009a\_31b\_f1 and earlier allows loading any Groovy source files on the classpath of Jenkins and… - Severity: Unrated - Published: May 17, 2022 - Affected: fixed in 2692.v76b. - Fixed in 2692.v76b_089ccd026 (released Feb 13, 2024, 637 days after disclosure, the advisory names 2692.v76b, which was never published). - The latest release, 4403.v471713a_cea_19, is not affected. ### [CVE-2022-25180](https://cve.now/CVE-2022-25180): Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds… - Severity: Unrated - Published: Feb 15, 2022 - Affected: fixed in 2656.vf7a_e7b_75a_457. - Fixed in 2656.vf7a_e7b_75a_457 (released Feb 13, 2024, 728 days after disclosure). - The latest release, 4403.v471713a_cea_19, is not affected. ### [CVE-2022-25176](https://cve.now/CVE-2022-25176): Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for… - Severity: Unrated - Published: Feb 15, 2022 - Affected: from 2.93, fixed in 2.94.1; fixed in 2.92.1; from 2.95, fixed in 2648.2651.v230593e03e9f. - Fixed in 2.92.1 (released Feb 13, 2024, 728 days after disclosure), 2.94.1 (released Feb 13, 2024, 728 days after disclosure) and 2648.2651.v230593e03e9f (released Feb 13, 2024, 728 days after disclosure). - The latest release, 4403.v471713a_cea_19, is not affected. ### [CVE-2022-25173](https://cve.now/CVE-2022-25173): Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the… - Severity: Unrated - Published: Feb 15, 2022 - Affected: from 2646.v6ed3b5b01ff1, fixed in 2656.vf7a; from 2.93, fixed in 2.94.1; fixed in 2.92.1. - Fixed in 2.92.1 (released Feb 13, 2024, 728 days after disclosure), 2.94.1 (released Feb 13, 2024, 728 days after disclosure) and 2656.vf7a_e7b_75a_457 (released Feb 13, 2024, 728 days after disclosure, the advisory names 2656.vf7a, which was never published). - The latest release, 4403.v471713a_cea_19, is not affected. ### [CVE-2020-2109](https://cve.now/CVE-2020-2109): Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in… - Severity: Unrated - Published: Feb 12, 2020 - Affected: fixed in 2.79. - Fixed in 2.79 (released Feb 13, 2024, 1462 days after disclosure). - The latest release, 4403.v471713a_cea_19, is not affected. ### [CVE-2019-1003041](https://cve.now/CVE-2019-1003041): A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in… - Severity: Unrated - Published: Mar 28, 2019 - Affected: fixed in 2.65. - Fixed in 2.65 (released Feb 13, 2024, 1783 days after disclosure). - The latest release, 4403.v471713a_cea_19, is not affected. ### [CVE-2019-1003030](https://cve.now/CVE-2019-1003030): A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/wo - Severity: Critical 9.9 · KEV - Published: Mar 8, 2019 - Affected: fixed in 2.64. - Fixed in 2.64 (released Feb 13, 2024, 1803 days after disclosure). - The latest release, 4403.v471713a_cea_19, is not affected. ### [CVE-2018-1000866](https://cve.now/CVE-2018-1000866): A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in… - Severity: Unrated - Published: Dec 10, 2018 - Affected: fixed in 2.60. - Fixed in 2.60 (released Feb 13, 2024, 1891 days after disclosure). - The latest release, 4403.v471713a_cea_19, is not affected. ### [CVE-2017-1000096](https://cve.now/CVE-2017-1000096): Arbitrary code execution due to incomplete sandbox protection: Constructors, instance variable initializers, and instance initializers in… - Severity: Unrated - Published: Oct 4, 2017 - Affected: fixed in 2.36.1. - Fixed in 2.36.1 (released Feb 13, 2024, 2323 days after disclosure). - The latest release, 4403.v471713a_cea_19, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.jenkins-ci.plugins.workflow:workflow-cps Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.