CVE-2023-24422: Sandbox bypass in Jenkins Script Security Plugin
Summary
CVE-2023-24422: Sandbox bypass in Jenkins Script Security Plugin. Affects org.jenkins-ci.plugins:script-security versions < 1229.v4880b. Fixed in 1229.v4880b. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Script Security Plugin is a component of the Jenkins automation server that provides a sandbox environment for executing scripts, including Pipelines. It allows users to define and run sandboxed scripts, ensuring that they do not have access to sensitive resources or perform malicious actions. The plugin is widely used in Jenkins installations to enhance security and control over script execution.
Vulnerability Detail
A sandbox bypass vulnerability has been discovered in the Jenkins Script Security Plugin version 1228.vd93135a_2fb_25 and earlier. This vulnerability allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection mechanism. By exploiting this vulnerability, an attacker can execute arbitrary code in the context of the Jenkins controller JVM. The vulnerability originates from a flaw in the handling of map constructors within the plugin.
How To Fix
Latest published version: 1436.v1082791135e4 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1229.v4880b
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the execution of sandboxed scripts until the plugin is updated. This can be done by modifying the Jenkins configuration to disallow the execution of sandboxed scripts. However, this workaround may impact the functionality of certain Jenkins jobs or Pipelines that rely on sandboxed script execution.
Conclusion
The sandbox bypass vulnerability in the Jenkins Script Security Plugin poses a significant risk to Jenkins installations. It allows attackers to execute arbitrary code in the context of the Jenkins controller JVM, potentially leading to unauthorized access and compromise of the entire Jenkins environment. It is strongly recommended to update the plugin to the latest version (1229.v4880b or later) to fix this vulnerability. Users can also utilize Vulert, a tool that monitors and alerts for open-source vulnerabilities, to check if their Jenkins installation is affected by this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:script-security →
FAQ
The vulnerability allows attackers to execute arbitrary code in the context of the Jenkins controller JVM. This can lead to unauthorized access, data breaches, and potential compromise of the entire Jenkins installation.
Users of Jenkins installations with the affected versions of the Jenkins Script Security Plugin (1228.vd93135a_2fb_25 and earlier) are vulnerable to this issue. Users who have enabled the execution of sandboxed scripts are particularly at risk.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, given the severity of the issue, it is advisable to apply the recommended fix as soon as possible.
No, this vulnerability requires an attacker to have permission to define and run sandboxed scripts within the Jenkins installation. It cannot be exploited remotely without prior access to the Jenkins environment.
Yes, the CVSS score for this vulnerability is 8.8, indicating a high severity level. It is crucial to address this vulnerability promptly to mitigate the associated risks.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:script-security.
