Every CVE Search/ Get API key

CVE-2019-1003030

Sandbox bypass in Jenkins Pipeline: Groovy Plugin

9.9 CriticalIn KEVPublic exploitFix available

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

97.1%Up 89.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.9

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

Record
CVE-2019-1003030
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0
6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness
CWE-693
Updated
2026-11-02
CVE List 9.9

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

Record
CVE-2019-1003030
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-693
Updated
2026-11-02
EUVDEUVD-2022-5117 9.9

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

Record
EUVD-2022-5117
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-r6mc-mrvr-23cr 9.9

Sandbox bypass in Jenkins Pipeline: Groovy Plugin

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

Record
GHSA-r6mc-mrvr-23cr
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:H
Weakness
CWE-693
Updated
2026-11-02
CISA KEV No score

Jenkins Matrix Project Plugin Remote Code Execution Vulnerability

Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution.

Record
CVE-2019-1003030
Updated
2026-11-02
OSV 9.9

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

Record
CVE-2019-1003030
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-r6mc-mrvr-23cr 9.9

Sandbox bypass in Jenkins Pipeline: Groovy Plugin

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

Record
GHSA-r6mc-mrvr-23cr
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:H
Weakness
CWE-693
Updated
2026-11-02
OSVRHSA-2019:0739 8.8

Red Hat Security Advisory: Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins security update

Record
RHSA-2019:0739
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.jenkins-ci.plugins.workflow:workflow-cps
Maven
 before 2.64
2.64
org.jenkins-ci.plugins.workflow:workflow-cps
Maven
 before 2.64, plus listed versions
0.1-beta-10.1-beta-20.1-beta-30.1-beta-40.1-beta-5
Show 45 moreShow less
0.1-beta-60.1-beta-70.1-beta-81.01.0-beta-11.11.101.10-beta-11.10.11.111.11-beta-11.11-beta-21.11-beta-31.11-beta-41.121.12-beta-11.12-beta-21.12-beta-31.131.141.14-beta-11.14.11.14.1-beta-11.14.21.151.15-beta-11.21.31.41.4.11.4.21.4.31.4.3-beta-11.51.61.6-alpha-11.71.7-alpha-11.81.91.9-beta-12.02.12.102.11
2.64
jenkins-2-plugins
Red Hat:openshift:3.11::el7
From an advisory covering 6 CVEs
 before 0:3.11.1552336312-1.el7
0:3.11.1552336312-1.el7

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBJenkins 2.63 - Sandbox bypass in pipeline: Groovy plug-in2020-10-19
PoC in GitHubovergrowncarrot1/CVE-2019-10030302025-03-01
PoC in GitHubcyberbelly/PoC-CVE-2019-10030302026-07-11
NucleiJenkins Pipeline Groovy Plugin <=2.63 - Insecure Deserialization

History

History
RecordedChangedSources
affected
exploitation, exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-1003030 is a critical vulnerability (CVSS 9.9) in Jenkins Project Pipeline: Groovy Plugin, published March 8, 2019. CISA lists it as known to be exploited, since March 25, 2022. EUVD reports exploitation since March 25, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 97.1%, the 99th percentile. Fixed in org.jenkins-ci.plugins.workflow:workflow-cps 2.64.

References

Show 30 moreShow less
This page doesn't list everything

Left out here: 79 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open