CVE-2019-1003030: Sandbox bypass in Jenkins Pipeline: Groovy Plugin
Summary
CVE-2019-1003030: Sandbox bypass in Jenkins Pipeline: Groovy Plugin. Affects org.jenkins-ci.plugins.workflow:workflow-cps versions < 2.64. Fixed in 2.64. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Jenkins Pipeline: Groovy Plugin is a plugin for Jenkins, an open-source automation server. It allows users to define and manage their pipelines using Groovy scripting language. The plugin provides a sandbox environment to execute pipeline scripts securely. However, a vulnerability has been discovered in versions 2.63 and earlier of the plugin that allows attackers with control over pipeline scripts to bypass the sandbox and execute arbitrary code on the Jenkins master JVM.
Vulnerability Detail
The vulnerability originates from a flaw in the pom.xml and CpsGroovyShell.java files of the Jenkins Pipeline: Groovy Plugin. Attackers who can control pipeline scripts can exploit this flaw to execute arbitrary code on the Jenkins master JVM. This can lead to unauthorized access, data breaches, and potential compromise of the entire Jenkins server. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.9.
How To Fix
Latest published version: 4395.v738456a_5da_6b_ as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.64
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrade is not possible, users can apply a workaround by disabling the use of pipeline scripts from untrusted sources. This can be done by configuring Jenkins to only allow pipeline scripts from trusted repositories or by manually reviewing and approving all pipeline scripts before execution. Here is an example of how to configure Jenkins to only allow pipeline scripts from trusted repositories:
- Go to Jenkins global configuration settings.
- Find the 'Pipeline' section.
- Enable the 'Pipeline script from SCM' option.
- Configure the SCM repository to point to a trusted repository.
- Save the configuration.
By following this workaround, the risk of executing malicious pipeline scripts can be mitigated until the plugin is updated.
Conclusion
The Jenkins Pipeline: Groovy Plugin is vulnerable to a sandbox bypass issue that allows attackers to execute arbitrary code on the Jenkins master JVM. Users are advised to upgrade to version 2.64 or later of the plugin to fix this vulnerability. If immediate upgrade is not possible, applying a workaround by restricting pipeline scripts to trusted repositories can help mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins.workflow:workflow-cps →
FAQ
Jenkins Pipeline: Groovy Plugin is a plugin for Jenkins that allows users to define and manage their pipelines using Groovy scripting language.
This vulnerability allows attackers with control over pipeline scripts to execute arbitrary code on the Jenkins master JVM, potentially leading to unauthorized access, data breaches, and compromise of the Jenkins server.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.9.
To fix this vulnerability, users should upgrade to version 2.64 or later of the Jenkins Pipeline: Groovy Plugin.
Yes, users can apply a workaround by disabling the use of pipeline scripts from untrusted sources and only allowing scripts from trusted repositories.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins.workflow:workflow-cps.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
