CVE-2022-25182: Protection Mechanism Failure in Jenkins Pipeline: Shared Groovy Libraries Plugin
Summary
CVE-2022-25182: Jenkins Pipeline: Deprecated Groovy Libraries Plugin Protection Mechanism Failure. Affects org.jenkins-ci.plugins.workflow:workflow-cps-global-lib versions < 561.va_ce0de3c2d69. Fixed in 561.va_ce0de3c2d69. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Pipeline: Shared Groovy Libraries Plugin is a component of the Jenkins automation server that allows users to define and share reusable Groovy libraries for their Jenkins pipelines. These libraries provide common functionality and can be used across multiple projects. The plugin integrates with the Jenkins Pipeline feature, which allows users to define their build pipelines as code. By configuring a global Pipeline library, users can easily access and utilize these shared libraries in their Jenkins pipelines.
Vulnerability Detail
A sandbox bypass vulnerability has been discovered in Jenkins Pipeline: Shared Groovy Libraries Plugin version 552.vd9cc05b8a2e1 and earlier. This vulnerability allows attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller JVM. The vulnerability can be exploited by using specially crafted library names when a global Pipeline library is already configured. By exploiting this vulnerability, an attacker can gain unauthorized access to the Jenkins controller and execute arbitrary code, potentially leading to further compromise of the Jenkins environment.
How To Fix
Latest published version: 636.v3d2c06d018a_6 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
561.va_ce0de3c2d69
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly recommended to upgrade to the fixed version of the Jenkins Pipeline: Shared Groovy Libraries Plugin as soon as possible.
Conclusion
In conclusion, the Jenkins Pipeline: Shared Groovy Libraries Plugin is vulnerable to a sandbox bypass vulnerability that allows attackers to execute arbitrary code on the Jenkins controller JVM. To mitigate this risk, it is crucial to upgrade to the fixed version of the plugin. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins.workflow:workflow-cps-global-lib →
FAQ
This vulnerability allows attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller JVM. This can lead to unauthorized access to the Jenkins environment and potential compromise of the entire system.
Users of Jenkins Pipeline: Shared Groovy Libraries Plugin versions 552.vd9cc05b8a2e1 and earlier are affected by this vulnerability. If a global Pipeline library is configured and an attacker has Item/Configure permission, they can exploit this vulnerability.
There is no known public exploit for this vulnerability at the time of this advisory. However, it is important to apply the recommended fix to mitigate the risk of exploitation.
The only effective mitigation for this vulnerability is to upgrade to the fixed version of the Jenkins Pipeline: Shared Groovy Libraries Plugin. It is strongly recommended to update your Jenkins installation to the latest version of the plugin.
For more information about this vulnerability, you can refer to the official Jenkins security advisory: [link to advisory]
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins.workflow:workflow-cps-global-lib.
