CVE-2019-1003001

mediumpriority · attend · 75EPSS 0.861 · 100 %ileexploit · weaponizedEUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

3 exploits · weaponized

Likely / severe?

86.1% (100th) EPSS

CVSS 6.5 · medium

Is it mine?

6 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · scored 2026-10-27

A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–8.8

v2.06.5mediumAV:N/AC:L/Au:S/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 8 · impact 6.4

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 5.9

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-269USLLM-inferred

exploits (3)

Public proof-of-concept and weaponised exploit code.

exploit/multi/http/jenkins_metaprogrammingJenkins ACL Bypass and Metaprogramming RCEweaponized · metasploit
EDB-46427Jenkins Plugin Script Security < 1.50/Declarative < 1.3.4.1/Groovy < 2.61.1 - Remote Code Execution (PoC)functional · exploit_db
EDB-46572Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming Remote Code Execution (Metasploit)functional · exploit_db

affected products (6)

Products and version ranges known to be affected.

Jenkins Project Pipeline: Groovy Plugin≤ 2.61 and earlierenisa_euvdEU
jenkins pipeline: groovy≤ 2.61nvdUScpe:2.3:a:jenkins:pipeline\:_groovy:*:*:*:*:*:*:*:*
redhat openshift container platform= 3.11nvdUScpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*
Maven org.jenkins-ci.plugins.workflow:workflow-cps-parent< 2.61.1osvUSpkg:maven/org.jenkins-ci.plugins.workflow/workflow-cps-parent
Maven org.jenkins-ci.plugins:pipeline-model-definition< 1.3.4.1osvUSpkg:maven/org.jenkins-ci.plugins/pipeline-model-definition
Maven org.jenkins-ci.plugins:script-security< 1.50osvUSpkg:maven/org.jenkins-ci.plugins/script-security

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-6q78-6xvr-26fgJenkins Groovy Plugin sandbox bypass vulnerability2022-05-13ghsa · osvUS
Jenkins Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as `@Grab` to source code elements. Both the pipeline validation REST APIs and actual script/pipeline execution are affected. This allowed users with Overall/Read permission, or able to control Jenkinsfile or sandboxed Pipeline shared library contents in SCM, to bypass the sandbox protection and execute arbitrary code on the Jenkins controller. All known unsafe AST transformations in Groovy are now prohibited in sandboxed scripts.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd osv NVD CVE.org MITRE

published 2019-01-22modified 2026-06-17

references (20)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan