Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-2zhb-qfhq-xkdp
Vulnerability ID VCID-2zhb-qfhq-xkdp
Aliases CVE-2022-43405
GHSA-4hjj-9gp7-4frg
Summary Sandbox bypass vulnerability in Jenkins Pipeline: Groovy Libraries Plugin and Pipeline: Deprecated Groovy Libraries Plugin Pipeline: Groovy Libraries Plugin and older releases of the Pipeline: Deprecated Groovy Libraries Plugin (formerly Pipeline: Shared Groovy Libraries Plugin) define the l`ibrary` Pipeline step, which allows Pipeline authors to dynamically load Pipeline libraries. The return value of this step can be used to instantiate classes defined in the loaded library. In Pipeline: Groovy Libraries Plugin 612.v84da_9c54906d and earlier and in Pipeline: Deprecated Groovy Libraries Plugin 583.vf3b_454e43966 and earlier, the `library` step can be used to invoke sandbox-generated synthetic constructors in crafted untrusted libraries and construct any subclassable type. This is similar to SECURITY-582 in the [2017-08-07 security advisory](https://www.jenkins.io/security/advisory/2017-08-07/#multiple-groovy-language-features-allowed-script-security-plugin-sandbox-bypass), but in a different plugin. This vulnerability allows attackers with permission to define untrusted Pipeline libraries and to define and run sandboxed Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. Pipeline: Groovy Libraries Plugin 613.v9c41a_160233f rejects improper calls to sandbox-generated synthetic constructors when using the `library` step. Pipeline: Deprecated Groovy Libraries Plugin 588.v576c103a_ff86 no longer contains the `library` step. It has been moved into the Pipeline: Groovy Libraries Plugin.
Status Published
Exploitability 0.5
Weighted Severity 8.9
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-693 Protection Mechanism Failure
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 9.9 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-43405.json
epss 0.00184 https://api.first.org/data/v1/epss?cve=CVE-2022-43405
epss 0.00184 https://api.first.org/data/v1/epss?cve=CVE-2022-43405
epss 0.00184 https://api.first.org/data/v1/epss?cve=CVE-2022-43405
epss 0.00184 https://api.first.org/data/v1/epss?cve=CVE-2022-43405
epss 0.00184 https://api.first.org/data/v1/epss?cve=CVE-2022-43405
epss 0.00184 https://api.first.org/data/v1/epss?cve=CVE-2022-43405
epss 0.00184 https://api.first.org/data/v1/epss?cve=CVE-2022-43405
epss 0.00184 https://api.first.org/data/v1/epss?cve=CVE-2022-43405
epss 0.00184 https://api.first.org/data/v1/epss?cve=CVE-2022-43405
epss 0.00184 https://api.first.org/data/v1/epss?cve=CVE-2022-43405
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-4hjj-9gp7-4frg
cvssv3.1 8.8 https://nvd.nist.gov/vuln/detail/CVE-2022-43405
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2022-43405
cvssv3.1 8.8 https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(2)
generic_textual HIGH https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(2)
cvssv3.1 8.8 http://www.openwall.com/lists/oss-security/2022/10/19/3
generic_textual HIGH http://www.openwall.com/lists/oss-security/2022/10/19/3
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-43405.json
https://api.first.org/data/v1/epss?cve=CVE-2022-43405
https://nvd.nist.gov/vuln/detail/CVE-2022-43405
https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(2)
http://www.openwall.com/lists/oss-security/2022/10/19/3
2136374 https://bugzilla.redhat.com/show_bug.cgi?id=2136374
GHSA-4hjj-9gp7-4frg https://github.com/advisories/GHSA-4hjj-9gp7-4frg
RHSA-2023:0560 https://access.redhat.com/errata/RHSA-2023:0560
RHSA-2023:0777 https://access.redhat.com/errata/RHSA-2023:0777
RHSA-2023:1064 https://access.redhat.com/errata/RHSA-2023:1064
RHSA-2023:3198 https://access.redhat.com/errata/RHSA-2023:3198
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-43405.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-43405
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(2)
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at http://www.openwall.com/lists/oss-security/2022/10/19/3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.40152
EPSS Score 0.00184
Published At April 8, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:05:04.132922+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-4hjj-9gp7-4frg/GHSA-4hjj-9gp7-4frg.json 38.0.0