CVE-2019-1003029: Jenkins Script Security Plugin sandbox bypass allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.9 with network reachability, scope change and high confidentiality, integrity and availability impact, plus KEV listing and very high EPSS make this an urgent patch target.

What it is

The Jenkins Script Security Plugin 1.53 and earlier fails to properly enforce its Groovy sandbox in GroovySandbox.java and SecureGroovyScript.java, letting a user with only Overall/Read permission escape the sandbox and run arbitrary code on the Jenkins master JVM. Because the affected component is the sandbox itself, any script path that relies on it is suspect, and the flaw is remotely reachable over the network with low attack complexity.

Impact

An attacker with Overall/Read permission gains arbitrary code execution on the Jenkins master JVM, which can lead to full controller compromise, credential theft and lateral movement into build infrastructure.

Attack surface

Reached over the network (AV:N) through Jenkins script execution paths that use the Script Security sandbox; no user interaction is required, but the attacker needs at least Overall/Read permission (PR:L).

Exploitation

The vulnerability is listed in CISA KEV (added 2022-04-25) and has a high EPSS 30-day probability of 0.73854 (99.45th percentile), indicating active exploitation is expected; references include third-party advisories and a Packet Storm remote code execution writeup.

What to do

• Upgrade the Jenkins Script Security Plugin past 1.53 to the fixed release named in the Jenkins security advisory 2019-03-06 (SECURITY-1336).
• Apply the Red Hat errata RHSA-2019:0739 for OpenShift Container Platform deployments that bundle the affected plugin.
• Restrict Overall/Read permission to trusted accounts only, since that permission is sufficient to exploit the flaw.
• Audit and remove unused script execution features and plugins that depend on the Script Security sandbox.
• Monitor the Jenkins controller for unexpected restarts or outbound connections after plugin updates.

Detection

• Review Jenkins controller logs for Groovy script execution errors or sandbox rejection messages tied to Script Security.
• Alert on new or modified Jenkins jobs, pipeline scripts or plugin configurations created by accounts with only Overall/Read permission.
• Hunt for unexpected child processes or outbound network connections originating from the Jenkins master JVM.
• Correlate Jenkins authentication logs with script execution events to spot low-privilege accounts triggering script paths.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.