CVE-2020-2279: Sandbox bypass vulnerability in Jenkins Script Security Plugin
Summary
CVE-2020-2279: Sandbox bypass vulnerability in Jenkins Script Security Plugin. Affects org.jenkins-ci.plugins:script-security across 2 version ranges.
< 1.66.5
>= 1.67, < 1.75
Fixed in 1.66.5 or 1.75, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins Script Security Plugin is a tool that provides a sandbox feature allowing low privileged users to define and execute scripts, including Pipelines, in a safe manner. The plugin intercepts calls to code defined inside a sandboxed script and checks various allowlists to determine if the call is allowed. This feature is designed to protect the Jenkins controller JVM from executing potentially harmful code.
Vulnerability Detail
In versions 1.75 and 1.66.5 of Script Security Plugin, a sandbox bypass vulnerability exists. This vulnerability allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. The vulnerability arises from the fact that calls from outside a sandboxed script to code defined inside a sandboxed script were always allowed, potentially leading to the execution of untrusted code without sandbox protection.
How To Fix
Latest published version: 1436.v1082791135e4 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.66.51.66.5 -
>= 1.67, < 1.751.75
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading the affected plugins to the recommended versions is the only solution.
Conclusion
The Sandbox bypass vulnerability in Jenkins Script Security Plugin (CVE-2020-2279) allows attackers to execute arbitrary code in the context of the Jenkins controller JVM. To mitigate this vulnerability, it is crucial to upgrade the affected plugins to the recommended versions. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:script-security →
FAQ
This vulnerability allows attackers to execute arbitrary code in the context of the Jenkins controller JVM, potentially leading to unauthorized access, data breaches, or other malicious activities.
Users of Jenkins Script Security Plugin versions 1.75 and 1.66.5 are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report.
Yes, this vulnerability can be exploited remotely by attackers with permission to define and run sandboxed scripts in Jenkins.
Yes, upgrading the affected plugins to the recommended versions will fix this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:script-security.
