CVE-2020-2110: Improper Input Validation in Jenkins Script Security Plugin
Summary
CVE-2020-2110: Improper Input Validation in Jenkins Script Security Plugin. Affects org.jenkins-ci.plugins:script-security versions < 1.70. Fixed in 1.70. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Script Security Plugin is a component of the Jenkins automation server that provides a sandboxed environment for executing scripts. It allows users to define and run custom scripts within Jenkins, ensuring that they do not pose a security risk. The plugin is widely used in various software development and CI/CD pipelines. However, versions 1.69 and earlier of the plugin are vulnerable to improper input validation, which can be exploited to bypass sandbox protection during the script compilation phase.
Vulnerability Detail
The vulnerability in the Jenkins Script Security Plugin allows attackers to circumvent sandbox protection by applying AST transforming annotations to imports or using them inside other annotations during script compilation. This can lead to the execution of malicious code within the Jenkins environment, potentially compromising the integrity and confidentiality of the system. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: 1436.v1082791135e4 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.70
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of the Jenkins Script Security Plugin as soon as possible.
Conclusion
The Jenkins Script Security Plugin versions 1.69 and earlier are vulnerable to improper input validation, which can be exploited to bypass sandbox protection. Users should update to version 1.70 or later of the plugin to fix this vulnerability. It is recommended to apply the update as soon as possible to ensure the security of Jenkins environments. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:script-security →
FAQ
This vulnerability allows attackers to bypass sandbox protection in the Jenkins Script Security Plugin, potentially leading to the execution of malicious code within the Jenkins environment.
Users of Jenkins who have the Jenkins Script Security Plugin version 1.69 or earlier installed are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to update to the fixed version to mitigate the risk.
Yes, this vulnerability can be exploited remotely by sending specially crafted scripts to the Jenkins server.
Yes, this vulnerability has a CVSS score of 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:script-security.
