VYPR
← All advisories
Critical severityNVD Advisory· Published Oct 1, 2019· Updated Aug 4, 2024

CVE-2019-10431

CVE-2019-10431

Description

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors allowed attackers to execute arbitrary code in sandboxed scripts.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Jenkins Script Security Plugin 1.64 and earlier allows sandbox bypass via default parameter expressions in constructors, enabling arbitrary code execution.

Vulnerability

A sandbox bypass vulnerability exists in the Jenkins Script Security Plugin versions 1.64 and earlier. The issue arises from improper handling of default parameter expressions in constructors, which allowed scripts running in the sandbox to bypass security restrictions [3][4].

Exploitation

An attacker with the ability to specify and run sandboxed scripts (e.g., users with Job/Configure permission) can exploit this flaw. By crafting script code that leverages default parameter expressions, they can execute arbitrary code, circumventing the Groovy sandbox protections intended to limit script actions [2][4].

Impact

Successful exploitation gives the attacker full control over the Jenkins controller JVM. This includes the ability to read secrets, modify configuration, or execute arbitrary commands on the Jenkins server, potentially compromising the entire CI/CD pipeline [3][4].

Mitigation

The vulnerability is fixed in Script Security Plugin version 1.75 and later [1]. Users are strongly advised to update immediately. As a workaround, restrict the permissions of users who can run sandboxed scripts to trusted administrators only [2].

References
  1. script-security-plugin/CHANGELOG.md at 7bd58b8635709cecdb50018844e5d6dbe1ce13ea · jenkinsci/script-security-plugin
  2. GitHub - jenkinsci/script-security-plugin: Allows Jenkins admins to control what in-process scripts can be run by users
  3. NVD - CVE-2019-10431
  4. Jenkins Security Advisory 2019-10-01

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.jenkins-ci.plugins:script-securityMaven
< 1.651.65

Affected products

2

Patches

1
415b6e2f3fa0

[SECURITY-1579] Transform initial expressions for parameters in constructors that call super

https://github.com/jenkinsci/script-security-pluginDevin NusbaumSep 25, 2019via ghsa
commit
2 files changed · +14 −1
  • pom.xml+1 −1 modified
    @@ -51,7 +51,7 @@
     <dependency>
       <groupId>org.kohsuke</groupId>
       <artifactId>groovy-sandbox</artifactId>
-      <version>1.23</version>
+      <version>1.24</version>
       <exclusions>
         <exclusion>
           <groupId>org.codehaus.groovy</groupId>
  • src/test/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SandboxInterceptorTest.java+13 −0 modified
    @@ -1261,4 +1261,17 @@ public void scriptInitializersClassSyntax() throws Exception {
                 "import jenkins.model.Jenkins\n" +
                 "({ Jenkins.getInstance(); 1 }())++\n");
     }
+
+    @Issue("SECURITY-1579")
+    @Test public void blockInitialExpressionsInConstructorsCallingSuper() throws Exception {
+        assertRejected(new GenericWhitelist(), "staticMethod jenkins.model.Jenkins getInstance",
+                "import jenkins.model.Jenkins\n" +
+                "class B {}\n" +
+                "class A extends B {\n" +
+                "  A(x = Jenkins.getInstance()) {\n" +
+                "    super()\n" +
+                "  }\n" +
+                "}\n" +
+                "new A()\n");
+    }
 }

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.