GHSA-r6mc-mrvr-23cr GHSA-r6mc-mrvr-23cr
Sandbox bypass in Jenkins Pipeline: Groovy Plugin
- Severity
- 9.9 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 97.06%
- Chance of exploitation in the next 30 days. Higher than 99.89% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog
- Weakness
- CWE-693 Protection Mechanism Failure
- Fix
2.64- Upgrade org.jenkins-ci.plugins.workflow:workflow-cps to this version or later
Description
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.jenkins-ci.plugins.workflow:workflow-cps | < 2.64 |
2.64 |
| org.jenkins-ci.plugins.workflow:workflow-cps | < 2.64 |
2.64 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.jenkins-ci.plugins.workflow:workflow-cps Maven → 2.64
- maven
<dependency><groupId>org.jenkins-ci.plugins.workflow</groupId><artifactId>workflow-cps</artifactId><version>2.64</version></dependency>- gradle
implementation("org.jenkins-ci.plugins.workflow:workflow-cps:2.64")
Severity breakdown
CVSS 3.1 9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
- Exploit maturity
- H
Weakness
CWE-693: Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-27rf-8mjp-r363 Sandbox bypass vulnerabilities in Jenkins Script Security Plugin and in Pipeline: Groovy Plugin | Critical | Also affects org.jenkins-ci.plugins.workflow:workflow-cps |
| GHSA-7vr5-72w7-q6jc Sandbox bypass vulnerabilities in Jenkins Script Security Plugin and in Pipeline: Groovy Plugin | Critical | Also affects org.jenkins-ci.plugins.workflow:workflow-cps |
| GHSA-gqhm-4h93-rrhg Jenkins Script Security and Pipeline Groovy Plugins Sandbox Bypass | High | Also affects org.jenkins-ci.plugins.workflow:workflow-cps |
| GHSA-26mh-57q7-jfvr PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox | High | Same weakness, CWE-693 |
| GHSA-mrv2-3pqr-j5jr DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p) | High | Same weakness, CWE-693 |
| GHSA-5r62-gj48-897x Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context | High | Same weakness, CWE-693 |
| GHSA-9jww-cxg5-rj9m Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE | High | Same weakness, CWE-693 |
| GHSA-76pm-mq2q-9gcr Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image) | High | Same weakness, CWE-693 |
Credits: westonsteimel
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor