CVE-2020-2109: Improper Input Validation in Jenkins Pipeline: Groovy Plugin
Summary
CVE-2020-2109: Improper Input Validation in Jenkins Pipeline: Groovy Plugin. Affects org.jenkins-ci.plugins.workflow:workflow-cps versions < 2.79. Fixed in 2.79. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Pipeline: Groovy Plugin is a powerful tool that allows users to define and automate their Jenkins pipelines using Groovy scripts. It provides a flexible and extensible framework for defining continuous integration and delivery workflows. The plugin is widely used in the Jenkins community and offers various features such as sandbox protection to ensure the security of the pipeline scripts.
Vulnerability Detail
The Jenkins Pipeline: Groovy Plugin version 2.78 and earlier are affected by an improper input validation vulnerability. This vulnerability allows an attacker to bypass the sandbox protection mechanism through default parameter expressions in CPS-transformed methods. By exploiting this vulnerability, an attacker can execute arbitrary code with the privileges of the Jenkins user, potentially leading to unauthorized access, data manipulation, or system compromise. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: 4395.v738456a_5da_6b_ as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.79
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the use of default parameter expressions in CPS-transformed methods. This can be achieved by modifying the affected pipeline scripts to remove or replace any default parameter expressions. It is important to carefully review the scripts and ensure that the changes do not impact the intended functionality of the pipelines. Here is an example of how to modify a pipeline script to remove a default parameter expression:
Before:
defaultParams([myParam: 'defaultValue'])
After:
defaultParams([myParam: ''])
Conclusion
The Jenkins Pipeline: Groovy Plugin version 2.78 and earlier are vulnerable to an improper input validation issue that can be exploited to bypass the sandbox protection mechanism. It is crucial for users to update the plugin to version 2.79 or later to mitigate the risk. Additionally, users can apply a temporary workaround by modifying the affected pipeline scripts. Regularly monitoring and updating dependencies is essential to ensure the security of Jenkins instances. For further support or assistance, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins.workflow:workflow-cps →
FAQ
This vulnerability allows an attacker to bypass the sandbox protection mechanism in the Jenkins Pipeline: Groovy Plugin. By exploiting this vulnerability, an attacker can execute arbitrary code with the privileges of the Jenkins user, potentially leading to unauthorized access, data manipulation, or system compromise.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Simply provide the URL of your Jenkins instance and Vulert will analyze the associated pom.xml file to identify any vulnerable dependencies.
Yes, the fix for this vulnerability is available in Jenkins Pipeline: Groovy Plugin version 2.79 or later. It is recommended to update the plugin to the latest version to mitigate the risk.
Yes, as a temporary workaround, you can modify the affected pipeline scripts to remove or replace any default parameter expressions. However, it is important to review and validate the changes to ensure the continued functionality of the pipelines.
For further support or assistance regarding the remediation of this vulnerability, you can contact info@devnack.com. Our team of experts will be happy to assist you.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins.workflow:workflow-cps.
