CVE-2019-10431: Improper Control of Generation of Code in Jenkins Script Security Plugin
Summary
CVE-2019-10431: Improper Control of Generation of Code in Jenkins Script Security Plugin. Affects org.jenkins-ci.plugins:script-security versions < 1.65. Fixed in 1.65. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Script Security Plugin is a component of the Jenkins automation server that provides a sandboxed environment for executing scripts. It allows users to define and run custom scripts within Jenkins, providing flexibility and extensibility to the platform. The plugin is widely used in various industries for automating build, test, and deployment processes. However, versions 1.64 and earlier of the plugin are vulnerable to a sandbox bypass issue, which can lead to the execution of arbitrary code in sandboxed scripts.
Vulnerability Detail
The vulnerability arises from the improper handling of default parameter expressions in constructors within the Jenkins Script Security Plugin. Attackers can exploit this flaw to bypass the sandbox restrictions and execute arbitrary code within sandboxed scripts. This can potentially lead to unauthorized access, data breaches, and the compromise of the Jenkins automation server. The vulnerability has been assigned a CVSS score of 9.9, indicating its critical severity.
How To Fix
Latest published version: 1436.v1082791135e4 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.65
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade the Jenkins Script Security Plugin to the fixed version to mitigate the risk of exploitation.
Conclusion
The Jenkins Script Security Plugin versions 1.64 and earlier are vulnerable to a sandbox bypass issue, allowing attackers to execute arbitrary code within sandboxed scripts. To mitigate this risk, it is crucial to upgrade the plugin to version 1.65 or later. Regularly checking for updates and promptly applying them is essential to ensure the security of the Jenkins automation server. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:script-security →
FAQ
The Jenkins Script Security Plugin is a component of the Jenkins automation server that provides a sandboxed environment for executing scripts. It allows users to define and run custom scripts within Jenkins, providing flexibility and extensibility to the platform.
The vulnerability allows attackers to bypass the sandbox restrictions and execute arbitrary code within sandboxed scripts. This can potentially lead to unauthorized access, data breaches, and the compromise of the Jenkins automation server.
The CVSS score of this vulnerability is 9.9, indicating its critical severity.
To fix this vulnerability, it is recommended to upgrade the Jenkins Script Security Plugin to version 1.65 or later. This version includes a patch that addresses the sandbox bypass issue.
There is no known workaround for this vulnerability. It is essential to upgrade the Jenkins Script Security Plugin to the fixed version to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:script-security.
