CVE-2019-1003029

Sandbox bypass in Script Security Plugin

9.9 CriticalIn KEVPublic exploitFix available

A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

74.4%Up 41.5 points since Apr 14, 2021

What each source reports

NVD Score used 9.9

Record: CVE-2019-1003029
CVSS 3.1: 9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0: 6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Updated: 2026-11-02

CVE List 9.9

Record: CVE-2019-1003029
CVSS 3.1: 9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2022-5866 9.9

Record: EUVD-2022-5866
CVSS 3.1: 9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-xvxq-hq48-xphm 9.9

Sandbox bypass in Script Security Plugin

Record: GHSA-xvxq-hq48-xphm
CVSS 3.1: 9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:H
Weakness: CWE-693
Updated: 2026-11-02

CISA KEV No score

Jenkins Script Security Plugin Sandbox Bypass Vulnerability

Jenkins Script Security Plugin contains a protection mechanism failure, allowing an attacker to bypass the sandbox.

Record: CVE-2019-1003029
Updated: 2026-11-02

OSV 9.9

Record: CVE-2019-1003029
CVSS 3.1: 9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-xvxq-hq48-xphm 9.9

Sandbox bypass in Script Security Plugin

Record: GHSA-xvxq-hq48-xphm
CVSS 3.1: 9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:H
Weakness: CWE-693
Updated: 2026-11-02

OSVRHSA-2019:0739 8.8

Red Hat Security Advisory: Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins security update

Record: RHSA-2019:0739
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.jenkins-ci.plugins:script-security` Maven	before 1.54	1.54
`org.jenkins-ci.plugins:script-security` Maven	before 1.54, plus listed versions 1.01.0-beta-11.0-beta-21.0-beta-31.0-beta-4 Show 45 moreShow less 1.0-beta-51.0-beta-61.11.101.111.121.131.141.151.161.171.181.18.11.191.21.201.211.221.231.241.251.261.271.281.291.29.11.31.301.311.331.341.351.361.371.381.391.41.401.411.421.431.441.44.11.451.46	1.54
`jenkins-2-plugins` Red Hat:openshift:3.11::el7 From an advisory covering 6 CVEs	before 0:3.11.1552336312-1.el7	0:3.11.1552336312-1.el7

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	Jenkins ACL Bypass and Metaprogramming RCE	2019-01-08

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected
Nov 3, 2026	exploitation
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-1003029 is a critical vulnerability (CVSS 9.9) in Jenkins Script Security Plugin, published March 8, 2019. CISA lists it as known to be exploited, since April 25, 2022. EUVD reports exploitation since April 25, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 74.4%, the 99th percentile. Fixed in org.jenkins-ci.plugins:script-security 1.54.

References

Show 30 moreShow less

This page doesn't list everything

Left out here: 13 versions. The JSON record has them.