CVE-2019-10356: Jenkins Script Security Plugin - Return of Pointer Value Outside of Expected Range
Summary
CVE-2019-10356: Return of Pointer Value Outside of Expected Rang in Jenkins Script Security Plugin. Affects org.jenkins-ci.plugins:script-security versions < 1.62. Fixed in 1.62. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Script Security Plugin is a component of the Jenkins automation server that provides a sandbox environment for executing scripts. It allows users to write and run custom scripts securely within Jenkins. The plugin ensures that the scripts adhere to a set of predefined security restrictions to prevent unauthorized access or malicious activities. However, versions 1.61 and earlier of the plugin contain a vulnerability that allows attackers to bypass the sandbox and execute arbitrary code in the context of sandboxed scripts.
Vulnerability Detail
The vulnerability in the Jenkins Script Security Plugin arises from the mishandling of method pointer expressions. By exploiting this flaw, an attacker can return a pointer value outside of the expected range, leading to the execution of arbitrary code within sandboxed scripts. This can result in unauthorized access, data manipulation, or other malicious activities depending on the intentions of the attacker. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: 1436.v1082791135e4 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.62
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable or restrict the usage of the affected plugin until the update is applied. This can be done by disabling the plugin in the Jenkins configuration or by restricting access to the plugin for untrusted users. However, it is strongly advised to apply the official fix as soon as possible to fully mitigate the vulnerability.
Conclusion
The Jenkins Script Security Plugin versions 1.61 and earlier are vulnerable to a sandbox bypass vulnerability that allows the execution of arbitrary code within sandboxed scripts. To mitigate this vulnerability, it is crucial to upgrade to version 1.62 or later of the plugin. Users can also utilize Vulert (https://vulert.com) to monitor and receive real-time alerts for open-source vulnerabilities in their software without requiring access to the code or installation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:script-security →
FAQ
The vulnerability allows attackers to execute arbitrary code within sandboxed scripts, potentially leading to unauthorized access, data manipulation, or other malicious activities.
Versions 1.61 and earlier of the Jenkins Script Security Plugin are affected by this vulnerability.
Yes, upgrading to version 1.62 or later of the Jenkins Script Security Plugin fixes this vulnerability.
As a temporary workaround, users can disable or restrict the usage of the affected plugin until the update is applied.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:script-security.
