CVE-2020-2135: Sandbox bypass vulnerability in Script Security Plugin
Summary
CVE-2020-2135: Sandbox bypass vulnerability in Script Security Plugin. Affects org.jenkins-ci.plugins:script-security versions < 1.71. Fixed in 1.71. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Script Security Plugin is a component of Jenkins, an open-source automation server. It provides a sandbox environment for executing scripts, ensuring that they do not have access to sensitive resources or perform malicious actions. The plugin allows users to define and run scripts securely within Jenkins. However, versions 1.70 and earlier of the Script Security Plugin contain a sandbox bypass vulnerability that can be exploited by attackers to execute arbitrary code in the context of the Jenkins controller JVM.
Vulnerability Detail
The sandbox bypass vulnerability in Script Security Plugin versions 1.70 and earlier can be exploited through crafted constructor calls and bodies, as well as crafted method calls on objects implementing GroovyInterceptable. This allows attackers who can specify and run sandboxed scripts to execute arbitrary code within the Jenkins controller JVM. The incomplete fix of SECURITY-582 contributes to the vulnerability. Script Security Plugin version 1.71 introduces additional restrictions and sanity checks to prevent the construction of super constructors without being intercepted by the sandbox. It also intercepts method calls on objects implementing GroovyInterceptable as calls to GroovyObject#invokeMethod(String, Object), which is considered dangerous and should not be approved for use in the sandbox.
How To Fix
Latest published version: 1436.v1082791135e4 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.71
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the Script Security Plugin.
Conclusion
The Script Security Plugin in Jenkins versions 1.70 and earlier is vulnerable to a sandbox bypass, allowing attackers to execute arbitrary code within the Jenkins controller JVM. Upgrading to version 1.71 or later of the plugin is recommended to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:script-security →
FAQ
The vulnerability allows attackers to execute arbitrary code within the Jenkins controller JVM, potentially leading to unauthorized access, data breaches, or further compromise of the Jenkins environment.
No, only versions 1.70 and earlier of the Script Security Plugin are affected. Version 1.71 and later include the necessary fixes to mitigate the vulnerability.
No, the vulnerability requires the ability to specify and run sandboxed scripts within the Jenkins environment. Remote exploitation is not possible without prior access to the Jenkins controller.
There is no evidence of active exploits in the wild at the time of this advisory. However, it is crucial to apply the recommended fix to prevent potential exploitation.
Yes, the CVSS score for this vulnerability is 8.8 (High).
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:script-security.
