Rapid7

vulnerability

Red Hat OpenShift: CVE-2022-43401: jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin

Severity
9
CVSS
(AV:N/AC:L/Au:S/C:C/I:C/A:C)
Published
Oct 19, 2022
Added
Feb 9, 2023
Modified
Mar 30, 2026

Description

A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Solution

linuxrpm-upgrade-jenkins-2-plugins
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.