Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.jenkins-ci.plugins:script-security

37 known vulnerabilities (2 critical, 4 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
1436.v1082791135e4 (Oct 14, 2026): no advisory with comparable ranges affects it; 12 advisories (CVE-2026-57281, CVE-2026-57280, CVE-2026-42519, …) can't be checked against versions
Newest unaffected release
1436.v1082791135e4 (Oct 14, 2026), the latest release, not counting 12 advisories without comparable ranges
Advisories
37 · 2 critical, 4 high, 2 medium
Dependents
1
Releases
166 since 1.0 (Feb 13, 2024)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-57281
    Its ranges can't be placed on these versions
    Its ranges can't be placed on these versions
  • CVE-2026-57280
    Its ranges can't be placed on these versions
    Its ranges can't be placed on these versions
  • CVE-2026-42519
    Its ranges can't be placed on these versions
    Its ranges can't be placed on these versions
  • CVE-2024-52549
    Its ranges can't be placed on these versions
    Its ranges can't be placed on these versions
  • CVE-2024-34145
    Its ranges can't be placed on these versions
    Its ranges can't be placed on these versions
  • CVE-2024-34144
    Its ranges can't be placed on these versions
    Its ranges can't be placed on these versions
  • CVE-2023-24422
    Its ranges can't be placed on these versions
    Its ranges can't be placed on these versions
  • CVE-2022-45379
    Its ranges can't be placed on these versions
    Its ranges can't be placed on these versions
  • CVE-2022-43404
    Its ranges can't be placed on these versions
    Its ranges can't be placed on these versions
  • CVE-2022-43403
    Its ranges can't be placed on these versions
    Its ranges can't be placed on these versions
  • CVE-2022-43401
    Its ranges can't be placed on these versions
    Its ranges can't be placed on these versions
  • CVE-2022-30946
    Its ranges can't be placed on these versions
    Its ranges can't be placed on these versions
Show all 37 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 37

  • Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions…

    Affected: fixed in 1402.1405.vc96e74964250.

  • Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed…

    Affected: fixed in 1402.1405.vc96e74964250.

  • CVE-2026-42519Medium 4.3

    A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission…

    Affected: fixed in 1402.v94c9ce464861.

  • CVE-2024-52549Medium 4.3

    Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not…

    Affected: fixed in 1368.vb.

  • A sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined classes in Jenkins Script…

    Affected: fixed in 1336.vf33a.

  • CVE-2024-34144Critical 9.8

    A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier…

    Affected: fixed in 1336.vf33a.

  • A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows…

    Affected: fixed in 1229.v4880b.

  • Jenkins Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as the SHA-1 hash of the script, making it…

    Affected: fixed in 1190.v65867a_a_47126.

  • A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic constructors in Jenkins…

    Affected: fixed in 1184.v85d16b_d851b_3.

  • A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin…

    Affected: fixed in 1184.v85d16b_d851b_3.

  • A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security…

    Affected: fixed in 1184.v85d16b_d851b_3.

  • A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to…

    Affected: fixed in 1172.v35f6a.

  • A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed…

    Affected: from 1.67, fixed in 1.75; fixed in 1.66.5.

    Fixed in 1.66.5 (released Feb 13, 2024, 1238 days after disclosure) and 1.75 (released Feb 13, 2024, 1238 days after disclosure).

    The latest release, 1436.v1082791135e4, is not affected.

  • Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script…

    Affected: fixed in 1.73.

    Fixed in 1.73 (released Feb 13, 2024, 1350 days after disclosure).

    The latest release, 1436.v1082791135e4, is not affected.

  • Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted method calls on objects that…

    Affected: fixed in 1.71.

    Fixed in 1.71 (released Feb 13, 2024, 1436 days after disclosure).

    The latest release, 1436.v1082791135e4, is not affected.

Show all 37 advisoriesShow fewer advisories

  • Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted constructor calls and crafted…

    Affected: fixed in 1.7.1.

    Fixed in 1.8 (released Feb 13, 2024, 1436 days after disclosure, the advisory names 1.7.1, which was never published).

    The latest release, 1436.v1082791135e4, is not affected.

  • Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by…

    Affected: fixed in 1.70.

    Fixed in 1.70 (released Feb 13, 2024, 1462 days after disclosure).

    The latest release, 1436.v1082791135e4, is not affected.

  • A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions…

    Affected: fixed in 1.68.

    Fixed in 1.68 (released Feb 13, 2024, 1545 days after disclosure).

    The latest release, 1436.v1082791135e4, is not affected.

  • A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions…

    Affected: fixed in 1.65.

    Fixed in 1.65 (released Feb 13, 2024, 1596 days after disclosure).

    The latest release, 1436.v1082791135e4, is not affected.

  • A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of subexpressions in increment…

    Affected: fixed in 1.63.

    Fixed in 1.63 (released Feb 13, 2024, 1615 days after disclosure).

    The latest release, 1436.v1082791135e4, is not affected.

  • A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property…

    Affected: fixed in 1.63.

    Fixed in 1.63 (released Feb 13, 2024, 1615 days after disclosure).

    The latest release, 1436.v1082791135e4, is not affected.

  • A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property…

    Affected: fixed in 1.63.

    Fixed in 1.63 (released Feb 13, 2024, 1615 days after disclosure).

    The latest release, 1436.v1082791135e4, is not affected.

  • A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of method names in method call…

    Affected: fixed in 1.63.

    Fixed in 1.63 (released Feb 13, 2024, 1615 days after disclosure).

    The latest release, 1436.v1082791135e4, is not affected.

  • A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions…

    Affected: fixed in 1.62.

    Fixed in 1.62 (released Feb 13, 2024, 1658 days after disclosure).

    The latest release, 1436.v1082791135e4, is not affected.

  • A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers…

    Affected: fixed in 1.62.

    Fixed in 1.62 (released Feb 13, 2024, 1658 days after disclosure).

    The latest release, 1436.v1082791135e4, is not affected.

  • A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in…

    Affected: fixed in 1.56.

    Fixed in 1.56 (released Feb 13, 2024, 1783 days after disclosure).

    The latest release, 1436.v1082791135e4, is not affected.

  • CVE-2019-1003029Critical 9.9 · KEV

    A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecuri

    Affected: fixed in 1.54.

    Fixed in 1.54 (released Feb 13, 2024, 1803 days after disclosure).

    The latest release, 1436.v1082791135e4, is not affected.

  • A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows…

    Affected: fixed in 1.53.

    Fixed in 1.53 (released Feb 13, 2024, 1819 days after disclosure).

    The latest release, 1436.v1082791135e4, is not affected.

  • A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in…

    Affected: fixed in 1.51.

    Fixed in 1.51 (released Feb 13, 2024, 1833 days after disclosure).

    The latest release, 1436.v1082791135e4, is not affected.

  • A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in…

    Affected: fixed in 1.50.

    Fixed in 1.50 (released Feb 13, 2024, 1848 days after disclosure).

    The latest release, 1436.v1082791135e4, is not affected.

  • A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in…

    Affected: fixed in 1.50.

    Fixed in 1.50 (released Feb 13, 2024, 1848 days after disclosure).

    The latest release, 1436.v1082791135e4, is not affected.

  • A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in…

    Affected: fixed in 1.48.

    Fixed in 1.48 (released Feb 13, 2024, 1891 days after disclosure).

    The latest release, 1436.v1082791135e4, is not affected.

  • A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in…

    Affected: fixed in 1.48.

    Fixed in 1.48 (released Feb 13, 2024, 1891 days after disclosure).

    The latest release, 1436.v1082791135e4, is not affected.

  • In Jenkins Script Security Plugin version 1.36 and earlier, users with the ability to configure sandboxed Groovy scripts are able to use a…

    Affected: fixed in 1.37.

    Fixed in 1.37 (released Feb 13, 2024, 2210 days after disclosure).

    The latest release, 1436.v1082791135e4, is not affected.

  • Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor…

    Affected: fixed in 1.31.

    Fixed in 1.31 (released Feb 13, 2024, 2323 days after disclosure).

    The latest release, 1436.v1082791135e4, is not affected.

  • The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object)…

    Affected: fixed in 1.29.1.

    Fixed in 1.29.1 (released Feb 13, 2024, 2323 days after disclosure).

    The latest release, 1436.v1082791135e4, is not affected.

  • The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a…

    Affected: fixed in 1.18.1.

    Fixed in 1.18.1 (released Feb 13, 2024, 2560 days after disclosure).

    The latest release, 1436.v1082791135e4, is not affected.