CVE-2022-43402: Jenkins Pipeline: Groovy Plugin allows sandbox protection bypass and arbitrary code execution
Summary
CVE-2022-43402: Jenkins Pipeline: Groovy Plugin allows sandbox protection bypass and arbitrary code execution. Affects org.jenkins-ci.plugins.workflow:workflow-cps versions < 2803.v1a_f77ffcc773. Fixed in 2803.v1a_f77ffcc773. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins Pipeline: Groovy Plugin is a powerful tool that allows users to define and run continuous delivery pipelines as code. It integrates with Jenkins, an open-source automation server, and enables developers to automate various stages of the software delivery process. The plugin leverages the Groovy language runtime to execute scripts and provides sandbox protection to prevent the execution of malicious code. However, a vulnerability has been discovered in versions 2802.v5ea_628154b_c2 and earlier, which allows attackers to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Vulnerability Detail
The vulnerability arises due to various implicit casts performed by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin. Attackers with permission to define and run sandboxed scripts, including Pipelines, can exploit this flaw to bypass the sandbox protection mechanism. By leveraging this vulnerability, an attacker can execute arbitrary code within the Jenkins controller JVM, potentially leading to unauthorized access, data breaches, or other malicious activities. The vulnerability has been assigned a CVSS score of 9.9, indicating its critical severity.
How To Fix
Latest published version: 4395.v738456a_5da_6b_ as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2803.v1a_f77ffcc773
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the execution of sandboxed scripts or restrict the permissions of users who can define and run such scripts. This can be achieved by modifying the Jenkins configuration or the access control settings. However, it is important to note that this workaround may limit the functionality and flexibility of the Jenkins Pipeline: Groovy Plugin.
Conclusion
The Jenkins Pipeline: Groovy Plugin vulnerability (CVE-2022-43402) allows attackers to bypass sandbox protection and execute arbitrary code. It is crucial for users to upgrade to the latest version of the plugin (2803.v1a_f77ffcc773 or later) to mitigate this vulnerability. Additionally, users can explore the Vulert playground (https://vulert.com/scanner) to check if their application is affected by this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins.workflow:workflow-cps →
FAQ
Jenkins Pipeline: Groovy Plugin is a plugin for Jenkins that allows users to define and run continuous delivery pipelines as code. It leverages the Groovy language runtime to execute scripts and provides sandbox protection to prevent the execution of malicious code.
This vulnerability allows attackers to bypass the sandbox protection mechanism in Jenkins Pipeline: Groovy Plugin and execute arbitrary code in the context of the Jenkins controller JVM. This can lead to unauthorized access, data breaches, or other malicious activities.
The CVSS score of this vulnerability is 9.9, indicating its critical severity.
To fix this vulnerability, it is recommended to upgrade to Pipeline: Groovy Plugin version 2803.v1a_f77ffcc773 or later. This version includes a fix that prevents the sandbox bypass.
As a temporary workaround, users can disable the execution of sandboxed scripts or restrict the permissions of users who can define and run such scripts. However, this may limit the functionality and flexibility of the plugin.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins.workflow:workflow-cps.
