VulnerableCode Package Details - pkg:maven/org.jenkins-ci.plugins/script-security@1.67

Search for packages

Vulnerability	Summary	Fixed by
VCID-24jy-j38r-13bv Aliases: CVE-2019-16538 GHSA-62pm-mgrh-7p69	Incorrect Authorization in Jenkins Script Security Plugin A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed attackers to execute arbitrary code in sandboxed scripts.	1.68 Affected by 0 other vulnerabilities.
VCID-3f3m-rqye-dbhe Aliases: CVE-2020-2279 GHSA-ccr8-4xr7-cgj3	Sandbox bypass vulnerability in Jenkins Script Security Plugin Jenkins Script Security Plugin provides a sandbox feature that allows low privileged users to define scripts, including Pipelines, that are generally safe to execute. Calls to code defined inside a sandboxed script are intercepted, and various allowlists are checked to determine whether the call is to be allowed. In Script Security Plugin 1.75 and 1.66.5, any calls from outside a sandboxed script to code defined inside a sandboxed script were always allowed. As sandboxed scripts can communicate their results through script return values and similar mechanisms, this could result in code defined inside of a sandboxed script to be called without sandbox protection. This vulnerability allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. Script Security Plugin 1.75 and 1.66.5 will prevent code defined inside a sandbox from being invoked outside a sandboxed script. In rare cases, invocations of sandboxed scripts may begin failing if the script return value or script binding include code defined in the sandbox and is further processed by the calling code. To resolve this issue, the affected values need to be converted inside the sandboxed script to a known safe type, such as `String`. For compatibility with this change, the following plugins should be upgraded to the versions specified: - [Email Extension Plugin](https://plugins.jenkins.io/email-ext) should be updated to version 2.77 or newer. - [Warnings Next Generation Plugin](https://plugins.jenkins.io/warnings-ng) should be updated to version 8.4.3 or newer. - [Warnings Plugin](https://plugins.jenkins.io/warnings) should be updated to version 5.0.2 or newer.	1.75 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-24jy-j38r-13bv
Aliases:
CVE-2019-16538
GHSA-62pm-mgrh-7p69

Incorrect Authorization in Jenkins Script Security Plugin A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed attackers to execute arbitrary code in sandboxed scripts.

1.68
Affected by 0 other vulnerabilities.

VCID-3f3m-rqye-dbhe
Aliases:
CVE-2020-2279
GHSA-ccr8-4xr7-cgj3

Sandbox bypass vulnerability in Jenkins Script Security Plugin Jenkins Script Security Plugin provides a sandbox feature that allows low privileged users to define scripts, including Pipelines, that are generally safe to execute. Calls to code defined inside a sandboxed script are intercepted, and various allowlists are checked to determine whether the call is to be allowed. In Script Security Plugin 1.75 and 1.66.5, any calls from outside a sandboxed script to code defined inside a sandboxed script were always allowed. As sandboxed scripts can communicate their results through script return values and similar mechanisms, this could result in code defined inside of a sandboxed script to be called without sandbox protection. This vulnerability allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. Script Security Plugin 1.75 and 1.66.5 will prevent code defined inside a sandbox from being invoked outside a sandboxed script. In rare cases, invocations of sandboxed scripts may begin failing if the script return value or script binding include code defined in the sandbox and is further processed by the calling code. To resolve this issue, the affected values need to be converted inside the sandboxed script to a known safe type, such as `String`. For compatibility with this change, the following plugins should be upgraded to the versions specified: - [Email Extension Plugin](https://plugins.jenkins.io/email-ext) should be updated to version 2.77 or newer. - [Warnings Next Generation Plugin](https://plugins.jenkins.io/warnings-ng) should be updated to version 8.4.3 or newer. - [Warnings Plugin](https://plugins.jenkins.io/warnings) should be updated to version 5.0.2 or newer.

1.75
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-04T14:32:22.001246+00:00	GHSA Importer	Affected by	VCID-24jy-j38r-13bv	https://github.com/advisories/GHSA-62pm-mgrh-7p69	38.1.0
2026-04-02T12:36:12.461881+00:00	GitLab Importer	Affected by	VCID-24jy-j38r-13bv	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.jenkins-ci.plugins/script-security/CVE-2019-16538.yml	38.0.0
2026-04-01T16:01:47.463074+00:00	GHSA Importer	Affected by	VCID-3f3m-rqye-dbhe	https://github.com/advisories/GHSA-ccr8-4xr7-cgj3	38.0.0