CVE-2024-34144: Jenkins Script Security Plugin sandbox bypass via crafted constructors

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 critical with high EPSS and arbitrary code execution on the Jenkins controller, though exploitation requires script-definition permission.

What it is

Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier fails to properly restrict crafted constructor bodies, allowing a sandbox bypass. An attacker who can define and run sandboxed scripts, including Pipelines, can escape the sandbox and run arbitrary code in the Jenkins controller JVM.

Impact

An attacker gains arbitrary code execution in the context of the Jenkins controller JVM, which can lead to full compromise of the Jenkins instance and its credentials.

Attack surface

Reached over the network through Jenkins script or Pipeline execution; the CVSS vector indicates no authentication or user interaction, but the description states the attacker needs permission to define and run sandboxed scripts, so some level of script-definition access is required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.48081 (98.8th percentile), indicating a high likelihood of exploitation activity; references are vendor advisory and mailing list only, with no public exploit tag.

What to do

• Upgrade Jenkins Script Security Plugin to a version later than 1335.vf07d9ce377a_e per the vendor advisory.
• Restrict who can define and run sandboxed scripts and Pipelines to trusted users only.
• Review and reduce permissions granted to Jenkins users and service accounts that can submit scripts.
• Monitor the Jenkins controller for unexpected process or command execution after script submissions.

Detection

• Audit Jenkins logs for script or Pipeline submissions that create unusual constructor bodies or unexpected class instantiation.
• Alert on child processes or command execution spawned by the Jenkins controller JVM.
• Track Script Security Plugin versions across controllers and flag any at or below 1335.vf07d9ce377a_e.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.