CVE-2019-1003029VulnerabilityPublished 04/25/2022Updated 10/24/2026

CVE-2019-1003029: Jenkins Script Security Plugin Sandbox Bypass Vulnerability

Affects Jenkins Script Security PluginSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 04/25/2022
KEV deadline: 05/16/2022
EPSS: 74.4% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2019-1003029 (opens in a new tab)

Description

CVE-2019-1003029 is a vulnerability in the Jenkins Script Security Plugin that allows attackers to bypass the sandbox protection mechanism. This flaw enables malicious scripts to execute outside the intended restricted environment, potentially leading to unauthorized code execution. The vulnerability has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.

Summary

The Jenkins Script Security Plugin contains a protection mechanism failure that allows an attacker to bypass the sandbox environment. This sandbox bypass vulnerability (CVE-2019-1003029) compromises the plugin's ability to restrict script execution, potentially enabling unauthorized or malicious code to run within Jenkins. The vulnerability is confirmed to have been exploited in the wild. No detailed version or patch information is available from the source data.

Impact

Successful exploitation of this vulnerability can lead to unauthorized code execution within Jenkins environments using the Script Security Plugin. This may allow attackers to perform actions beyond the sandbox restrictions, potentially compromising the integrity and security of the Jenkins server and its build processes. The vulnerability is rated as high severity and has known exploitation in the wild.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is confirmed, users should monitor Jenkins security advisories and consider restricting script execution privileges or disabling the Script Security Plugin if feasible to reduce risk.

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:27:14 UTC

References

Related threats