CVE-2019-1003000: Protection Mechanism Failure in Jenkins Script Security Plugin
Summary
CVE-2019-1003000: Protection Mechanism Failure in Jenkins Script Security Plugin. Affects org.jenkins-ci.plugins:script-security versions < 1.50. Fixed in 1.50. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Script Security Plugin is a component of the Jenkins automation server that provides a sandbox environment for executing scripts. It allows users to define and run scripts securely within a restricted environment. The plugin is widely used in Jenkins installations to enhance the flexibility and functionality of the automation server.
Vulnerability Detail
A sandbox bypass vulnerability exists in the Script Security Plugin version 1.49 and earlier. The vulnerability resides in the GroovySandbox.java file, which is responsible for enforcing the script execution restrictions. Attackers who can provide sandboxed scripts can exploit this flaw to execute arbitrary code on the Jenkins master JVM. This can lead to unauthorized access, data breaches, and potential compromise of the entire Jenkins environment.
How To Fix
Latest published version: 1436.v1082791135e4 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.50
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the Script Security Plugin if it is not essential for their Jenkins setup. However, this may limit the functionality of certain features that rely on the plugin. To disable the plugin, navigate to the Jenkins administration panel, go to 'Manage Jenkins' > 'Manage Plugins' > 'Installed' tab, and disable the 'Script Security Plugin'.
Conclusion
The Script Security Plugin in Jenkins is vulnerable to a sandbox bypass, allowing attackers to execute arbitrary code on the Jenkins master JVM. To mitigate this risk, it is crucial to upgrade the plugin to version 1.50 or later. Disabling the plugin temporarily can serve as a workaround, but it may limit certain features. For further assistance and support in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:script-security →
FAQ
The vulnerability allows attackers to execute arbitrary code on the Jenkins master JVM, potentially leading to unauthorized access, data breaches, and compromise of the entire Jenkins environment.
Versions 1.49 and earlier of the Script Security Plugin are affected by this vulnerability.
Yes, the vulnerability can be fixed by upgrading the Script Security Plugin to version 1.50 or later.
A temporary workaround is to disable the Script Security Plugin if it is not essential for the Jenkins setup.
For more information about this vulnerability, refer to the GitHub Security Advisory GHSA-784j-h234-m56x.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:script-security.
