CVE-2019-1003041: Sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin
Summary
CVE-2019-1003041: Sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin. Affects org.jenkins-ci.plugins.workflow:workflow-cps versions < 2.65. Fixed in 2.65. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins Pipeline: Groovy Plugin is a component of Jenkins, an open-source automation server. It allows users to define and manage their build pipelines using Groovy scripts. The plugin provides a sandbox environment to execute these scripts, ensuring security by restricting access to certain classes and methods. However, versions 2.64 and earlier of the plugin contain a sandbox bypass vulnerability that allows attackers to invoke arbitrary constructors in sandboxed scripts.
Vulnerability Detail
The sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin enables attackers to bypass the restricted environment and invoke arbitrary constructors in sandboxed scripts. This can lead to the execution of unauthorized code with the privileges of the Jenkins process. The vulnerability has a CVSS score of 9.8 (Critical) and can have severe consequences, including unauthorized access, data manipulation, and system compromise.
How To Fix
Latest published version: 4395.v738456a_5da_6b_ as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.65
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Jenkins Pipeline: Groovy Plugin to the fixed version as soon as possible to mitigate the risk of exploitation.
Conclusion
The sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin poses a significant risk to the security and integrity of Jenkins installations. It is crucial to update the plugin to version 2.65 or later to mitigate the vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins.workflow:workflow-cps →
FAQ
Jenkins Pipeline: Groovy Plugin is a component of Jenkins that allows users to define and manage build pipelines using Groovy scripts.
A sandbox bypass vulnerability is a security flaw that allows an attacker to bypass the restricted environment (sandbox) and execute unauthorized code with elevated privileges.
The vulnerability can lead to unauthorized access, data manipulation, and system compromise, potentially resulting in significant damage to the affected system.
To fix this vulnerability, update the Jenkins Pipeline: Groovy Plugin to version 2.65 or later.
No, there is no known workaround for this vulnerability. Updating the plugin to the fixed version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins.workflow:workflow-cps.
