# org.jenkins-ci.plugins:script-security (Maven) vulnerabilities 37 known vulnerabilities (2 critical, 4 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1436.v1082791135e4 (Oct 14, 2026): no advisory with comparable ranges affects it; 12 advisories (CVE-2026-57281, CVE-2026-57280, CVE-2026-42519, …) can't be checked against versions - Newest unaffected release: 1436.v1082791135e4 (Oct 14, 2026), the latest release, not counting 12 advisories without comparable ranges - Dependents: 1 - Releases: 166 since 1.0 (Feb 13, 2024) - Registry: https://central.sonatype.com/artifact/org.jenkins-ci.plugins/script-security - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-57281: its ranges can't be placed on these versions - CVE-2026-57280: its ranges can't be placed on these versions - CVE-2026-42519: its ranges can't be placed on these versions - CVE-2024-52549: its ranges can't be placed on these versions - CVE-2024-34145: its ranges can't be placed on these versions - CVE-2024-34144: its ranges can't be placed on these versions - CVE-2023-24422: its ranges can't be placed on these versions - CVE-2022-45379: its ranges can't be placed on these versions - CVE-2022-43404: its ranges can't be placed on these versions - CVE-2022-43403: its ranges can't be placed on these versions - CVE-2022-43401: its ranges can't be placed on these versions - CVE-2022-30946: its ranges can't be placed on these versions - CVE-2020-2279: 1.0-beta-1 to 1.66.4 (1.66.5 is outside it); 1.67 to 1.74 (1.75 is outside it) - CVE-2020-2190: 1.0-beta-1 to 1.72 (1.73 is outside it) - CVE-2020-2135: 1.0-beta-1 to 1.70 (1.71 is outside it) - CVE-2020-2134: 1.0-beta-1 to 1.7 (1.8 is outside it) - CVE-2020-2110: 1.0-beta-1 to 1.69 (1.70 is outside it) - CVE-2019-16538: 1.0-beta-1 to 1.67 (1.68 is outside it) - CVE-2019-10431: 1.0-beta-1 to 1.64 (1.65 is outside it) - CVE-2019-10400: 1.0-beta-1 to 1.62 (1.63 is outside it) - CVE-2019-10399: 1.0-beta-1 to 1.62 (1.63 is outside it) - CVE-2019-10394: 1.0-beta-1 to 1.62 (1.63 is outside it) - CVE-2019-10393: 1.0-beta-1 to 1.62 (1.63 is outside it) - CVE-2019-10356: 1.0-beta-1 to 1.61 (1.62 is outside it) - CVE-2019-10355: 1.0-beta-1 to 1.61 (1.62 is outside it) - CVE-2019-1003040: 1.0-beta-1 to 1.55 (1.56 is outside it) - CVE-2019-1003029: 1.0-beta-1 to 1.53 (1.54 is outside it) - CVE-2019-1003024: 1.0-beta-1 to 1.52 (1.53 is outside it) - CVE-2019-1003005: 1.0-beta-1 to 1.50 (1.51 is outside it) - CVE-2019-1003001: 1.0-beta-1 to 1.49 (1.50 is outside it) - CVE-2019-1003000: 1.0-beta-1 to 1.49 (1.50 is outside it) - CVE-2018-1000866: 1.0-beta-1 to 1.47 (1.48 is outside it) - CVE-2018-1000865: 1.0-beta-1 to 1.47 (1.48 is outside it) - CVE-2017-1000505: 1.0-beta-1 to 1.36 (1.37 is outside it) - CVE-2017-1000107: 1.0-beta-1 to 1.30 (1.31 is outside it) - CVE-2017-1000095: 1.0-beta-1 to 1.29 (1.29.1 is outside it) - CVE-2016-3102: 1.0-beta-1 to 1.18 (1.18.1 is outside it) ## Advisories (37) ### [CVE-2026-57281](https://cve.now/CVE-2026-57281): Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions… - Severity: High 7.5 - Published: Jun 24, 2026 - Affected: fixed in 1402.1405.vc96e74964250. ### [CVE-2026-57280](https://cve.now/CVE-2026-57280): Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed… - Severity: High 8.8 - Published: Jun 24, 2026 - Affected: fixed in 1402.1405.vc96e74964250. ### [CVE-2026-42519](https://cve.now/CVE-2026-42519): A missing permission check in Jenkins Script Security Plugin 1399.ve6a\_66547f6e1 and earlier allows attackers with Overall/Read permission… - Severity: Medium 4.3 - Published: Apr 29, 2026 - Affected: fixed in 1402.v94c9ce464861. ### [CVE-2024-52549](https://cve.now/CVE-2024-52549): Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va\_3b\_b\_89f8a\_95b\_ and 1362.1364.v4cf2dc5d8776, does not… - Severity: Medium 4.3 - Published: Nov 13, 2024 - Affected: fixed in 1368.vb. ### [CVE-2024-34145](https://cve.now/CVE-2024-34145): A sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined classes in Jenkins Script… - Severity: High 8.8 - Published: May 2, 2024 - Affected: fixed in 1336.vf33a. ### [CVE-2024-34144](https://cve.now/CVE-2024-34144): A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a\_e and earlier… - Severity: Critical 9.8 - Published: May 2, 2024 - Affected: fixed in 1336.vf33a. ### [CVE-2023-24422](https://cve.now/CVE-2023-24422): A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a\_2fb\_25 and earlier allows… - Severity: High 8.8 - Published: Jan 24, 2023 - Affected: fixed in 1229.v4880b. ### [CVE-2022-45379](https://cve.now/CVE-2022-45379): Jenkins Script Security Plugin 1189.vb\_a\_b\_7c8fd5fde and earlier stores whole-script approvals as the SHA-1 hash of the script, making it… - Severity: Unrated - Published: Nov 15, 2022 - Affected: fixed in 1190.v65867a_a_47126. ### [CVE-2022-43404](https://cve.now/CVE-2022-43404): A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic constructors in Jenkins… - Severity: Unrated - Published: Oct 19, 2022 - Affected: fixed in 1184.v85d16b_d851b_3. ### [CVE-2022-43403](https://cve.now/CVE-2022-43403): A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin… - Severity: Unrated - Published: Oct 19, 2022 - Affected: fixed in 1184.v85d16b_d851b_3. ### [CVE-2022-43401](https://cve.now/CVE-2022-43401): A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security… - Severity: Unrated - Published: Oct 19, 2022 - Affected: fixed in 1184.v85d16b_d851b_3. ### [CVE-2022-30946](https://cve.now/CVE-2022-30946): A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b\_73a\_69a\_08 and earlier allows attackers to… - Severity: Unrated - Published: May 17, 2022 - Affected: fixed in 1172.v35f6a. ### [CVE-2020-2279](https://cve.now/CVE-2020-2279): A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed… - Severity: Unrated - Published: Sep 23, 2020 - Affected: from 1.67, fixed in 1.75; fixed in 1.66.5. - Fixed in 1.66.5 (released Feb 13, 2024, 1238 days after disclosure) and 1.75 (released Feb 13, 2024, 1238 days after disclosure). - The latest release, 1436.v1082791135e4, is not affected. ### [CVE-2020-2190](https://cve.now/CVE-2020-2190): Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script… - Severity: Unrated - Published: Jun 3, 2020 - Affected: fixed in 1.73. - Fixed in 1.73 (released Feb 13, 2024, 1350 days after disclosure). - The latest release, 1436.v1082791135e4, is not affected. ### [CVE-2020-2135](https://cve.now/CVE-2020-2135): Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted method calls on objects that… - Severity: Unrated - Published: Mar 9, 2020 - Affected: fixed in 1.71. - Fixed in 1.71 (released Feb 13, 2024, 1436 days after disclosure). - The latest release, 1436.v1082791135e4, is not affected. ### [CVE-2020-2134](https://cve.now/CVE-2020-2134): Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted constructor calls and crafted… - Severity: Unrated - Published: Mar 9, 2020 - Affected: fixed in 1.7.1. - Fixed in 1.8 (released Feb 13, 2024, 1436 days after disclosure, the advisory names 1.7.1, which was never published). - The latest release, 1436.v1082791135e4, is not affected. ### [CVE-2020-2110](https://cve.now/CVE-2020-2110): Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by… - Severity: Unrated - Published: Feb 12, 2020 - Affected: fixed in 1.70. - Fixed in 1.70 (released Feb 13, 2024, 1462 days after disclosure). - The latest release, 1436.v1082791135e4, is not affected. ### [CVE-2019-16538](https://cve.now/CVE-2019-16538): A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions… - Severity: Unrated - Published: Nov 21, 2019 - Affected: fixed in 1.68. - Fixed in 1.68 (released Feb 13, 2024, 1545 days after disclosure). - The latest release, 1436.v1082791135e4, is not affected. ### [CVE-2019-10431](https://cve.now/CVE-2019-10431): A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions… - Severity: Unrated - Published: Oct 1, 2019 - Affected: fixed in 1.65. - Fixed in 1.65 (released Feb 13, 2024, 1596 days after disclosure). - The latest release, 1436.v1082791135e4, is not affected. ### [CVE-2019-10400](https://cve.now/CVE-2019-10400): A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of subexpressions in increment… - Severity: Unrated - Published: Sep 12, 2019 - Affected: fixed in 1.63. - Fixed in 1.63 (released Feb 13, 2024, 1615 days after disclosure). - The latest release, 1436.v1082791135e4, is not affected. ### [CVE-2019-10399](https://cve.now/CVE-2019-10399): A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property… - Severity: Unrated - Published: Sep 12, 2019 - Affected: fixed in 1.63. - Fixed in 1.63 (released Feb 13, 2024, 1615 days after disclosure). - The latest release, 1436.v1082791135e4, is not affected. ### [CVE-2019-10394](https://cve.now/CVE-2019-10394): A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property… - Severity: Unrated - Published: Sep 12, 2019 - Affected: fixed in 1.63. - Fixed in 1.63 (released Feb 13, 2024, 1615 days after disclosure). - The latest release, 1436.v1082791135e4, is not affected. ### [CVE-2019-10393](https://cve.now/CVE-2019-10393): A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of method names in method call… - Severity: Unrated - Published: Sep 12, 2019 - Affected: fixed in 1.63. - Fixed in 1.63 (released Feb 13, 2024, 1615 days after disclosure). - The latest release, 1436.v1082791135e4, is not affected. ### [CVE-2019-10356](https://cve.now/CVE-2019-10356): A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions… - Severity: Unrated - Published: Jul 31, 2019 - Affected: fixed in 1.62. - Fixed in 1.62 (released Feb 13, 2024, 1658 days after disclosure). - The latest release, 1436.v1082791135e4, is not affected. ### [CVE-2019-10355](https://cve.now/CVE-2019-10355): A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers… - Severity: Unrated - Published: Jul 31, 2019 - Affected: fixed in 1.62. - Fixed in 1.62 (released Feb 13, 2024, 1658 days after disclosure). - The latest release, 1436.v1082791135e4, is not affected. ### [CVE-2019-1003040](https://cve.now/CVE-2019-1003040): A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in… - Severity: Unrated - Published: Mar 28, 2019 - Affected: fixed in 1.56. - Fixed in 1.56 (released Feb 13, 2024, 1783 days after disclosure). - The latest release, 1436.v1082791135e4, is not affected. ### [CVE-2019-1003029](https://cve.now/CVE-2019-1003029): A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecuri - Severity: Critical 9.9 · KEV - Published: Mar 8, 2019 - Affected: fixed in 1.54. - Fixed in 1.54 (released Feb 13, 2024, 1803 days after disclosure). - The latest release, 1436.v1082791135e4, is not affected. ### [CVE-2019-1003024](https://cve.now/CVE-2019-1003024): A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows… - Severity: Unrated - Published: Feb 20, 2019 - Affected: fixed in 1.53. - Fixed in 1.53 (released Feb 13, 2024, 1819 days after disclosure). - The latest release, 1436.v1082791135e4, is not affected. ### [CVE-2019-1003005](https://cve.now/CVE-2019-1003005): A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in… - Severity: Unrated - Published: Feb 6, 2019 - Affected: fixed in 1.51. - Fixed in 1.51 (released Feb 13, 2024, 1833 days after disclosure). - The latest release, 1436.v1082791135e4, is not affected. ### [CVE-2019-1003001](https://cve.now/CVE-2019-1003001): A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in… - Severity: Unrated - Published: Jan 22, 2019 - Affected: fixed in 1.50. - Fixed in 1.50 (released Feb 13, 2024, 1848 days after disclosure). - The latest release, 1436.v1082791135e4, is not affected. ### [CVE-2019-1003000](https://cve.now/CVE-2019-1003000): A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in… - Severity: Unrated - Published: Jan 22, 2019 - Affected: fixed in 1.50. - Fixed in 1.50 (released Feb 13, 2024, 1848 days after disclosure). - The latest release, 1436.v1082791135e4, is not affected. ### [CVE-2018-1000866](https://cve.now/CVE-2018-1000866): A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in… - Severity: Unrated - Published: Dec 10, 2018 - Affected: fixed in 1.48. - Fixed in 1.48 (released Feb 13, 2024, 1891 days after disclosure). - The latest release, 1436.v1082791135e4, is not affected. ### [CVE-2018-1000865](https://cve.now/CVE-2018-1000865): A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in… - Severity: Unrated - Published: Dec 10, 2018 - Affected: fixed in 1.48. - Fixed in 1.48 (released Feb 13, 2024, 1891 days after disclosure). - The latest release, 1436.v1082791135e4, is not affected. ### [CVE-2017-1000505](https://cve.now/CVE-2017-1000505): In Jenkins Script Security Plugin version 1.36 and earlier, users with the ability to configure sandboxed Groovy scripts are able to use a… - Severity: Unrated - Published: Jan 25, 2018 - Affected: fixed in 1.37. - Fixed in 1.37 (released Feb 13, 2024, 2210 days after disclosure). - The latest release, 1436.v1082791135e4, is not affected. ### [CVE-2017-1000107](https://cve.now/CVE-2017-1000107): Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor… - Severity: Unrated - Published: Oct 4, 2017 - Affected: fixed in 1.31. - Fixed in 1.31 (released Feb 13, 2024, 2323 days after disclosure). - The latest release, 1436.v1082791135e4, is not affected. ### [CVE-2017-1000095](https://cve.now/CVE-2017-1000095): The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object)… - Severity: Unrated - Published: Oct 4, 2017 - Affected: fixed in 1.29.1. - Fixed in 1.29.1 (released Feb 13, 2024, 2323 days after disclosure). - The latest release, 1436.v1082791135e4, is not affected. ### [CVE-2016-3102](https://cve.now/CVE-2016-3102): The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a… - Severity: Unrated - Published: Feb 9, 2017 - Affected: fixed in 1.18.1. - Fixed in 1.18.1 (released Feb 13, 2024, 2560 days after disclosure). - The latest release, 1436.v1082791135e4, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.jenkins-ci.plugins:script-security Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.