CVE-2019-1003040: Sandbox bypass vulnerability in Jenkins Script Security Plugin
Summary
CVE-2019-1003040: Sandbox bypass vulnerability in Jenkins Script Security Plugin. Affects org.jenkins-ci.plugins:script-security versions < 1.56. Fixed in 1.56. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Script Security Plugin is a component of the Jenkins automation server that provides a sandbox environment for executing scripts. It allows users to define and run scripts securely within the Jenkins environment. The plugin is commonly used to enforce security restrictions on scripts executed by Jenkins. However, versions 1.55 and earlier of the plugin contain a sandbox bypass vulnerability that allows attackers to invoke arbitrary constructors in sandboxed scripts.
Vulnerability Detail
The sandbox bypass vulnerability in Jenkins Script Security Plugin allows attackers to bypass the security restrictions imposed by the sandbox environment. By invoking arbitrary constructors in sandboxed scripts, an attacker can execute unauthorized code and potentially gain elevated privileges within the Jenkins environment. This vulnerability poses a significant risk as it can lead to unauthorized access, data leakage, and potential compromise of the entire Jenkins automation server.
How To Fix
Latest published version: 1436.v1082791135e4 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.56
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading the Jenkins Script Security Plugin to the latest version.
Conclusion
The sandbox bypass vulnerability in Jenkins Script Security Plugin poses a significant risk to Jenkins installations. It allows attackers to execute unauthorized code and potentially gain elevated privileges. To mitigate this vulnerability, it is crucial to upgrade the Jenkins Script Security Plugin to version 1.56 or later. Additionally, users can utilize the Vulert Playground to check if their Jenkins installation is affected. For further support, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:script-security →
FAQ
This vulnerability allows attackers to bypass the sandbox environment in Jenkins and execute unauthorized code. It can lead to unauthorized access, data leakage, and potential compromise of the entire Jenkins automation server.
Versions 1.55 and earlier of the Jenkins Script Security Plugin are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading the Jenkins Script Security Plugin to the latest version.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities, including this specific vulnerability.
For further support on vulnerability remediation, you can reach out to info@devnack.com. Our team of experts can assist you in addressing and mitigating this vulnerability in your Jenkins installation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:script-security.
