CVE-2020-2190: Improper Neutralization of Input During Web Page Generation in Jenkins Script Security Plugin
Summary
CVE-2020-2190: Improper Neutralization of Input During Web Page Generation in Jenkins Script Security Plugin. Affects org.jenkins-ci.plugins:script-security versions < 1.73. Fixed in 1.73. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Script Security Plugin is a component of the Jenkins automation server that provides a sandboxed environment for executing scripts. It allows users to define and run custom scripts within Jenkins, providing flexibility and extensibility to the platform. The plugin is widely used in various software development and continuous integration workflows.
Vulnerability Detail
The Jenkins Script Security Plugin version 1.72 and earlier is affected by an improper neutralization of input vulnerability. Specifically, the plugin fails to properly escape pending or approved classpath entries on the In-process Script Approval page, leading to a stored cross-site scripting (XSS) vulnerability. An attacker can exploit this vulnerability by injecting malicious scripts into the classpath entries, which will be executed when the page is generated. This can result in arbitrary code execution in the context of the user viewing the page, potentially leading to unauthorized access, data theft, or further compromise of the Jenkins server.
How To Fix
Latest published version: 1436.v1082791135e4 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.73
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the In-process Script Approval page to mitigate the risk of exploitation. This can be done by removing the 'scriptApproval' permission from the Jenkins user's permissions or by restricting access to the page through Jenkins configuration. However, this workaround should only be considered as a temporary measure until the plugin can be updated to a secure version.
Conclusion
The Jenkins Script Security Plugin is vulnerable to a stored XSS issue that can be exploited by injecting malicious scripts into the classpath entries on the In-process Script Approval page. To mitigate this vulnerability, it is recommended to upgrade to version 1.73 or later of the plugin. Users can also temporarily disable the affected page as a workaround. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:script-security →
FAQ
The vulnerability allows an attacker to execute arbitrary code in the context of a user viewing the In-process Script Approval page. This can lead to unauthorized access, data theft, or further compromise of the Jenkins server.
No, only versions 1.72 and earlier are affected. The vulnerability has been fixed in version 1.73 and later.
At the time of this report, there are no known public exploits targeting this vulnerability. However, it is important to apply the recommended fixes as soon as possible to prevent potential exploitation.
No, this vulnerability requires an authenticated user with permission to access the In-process Script Approval page. It cannot be exploited remotely without valid credentials.
Yes, the CVSS score for this vulnerability is 5.4, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:script-security.
