High severity8.8NVD Advisory· Published Jan 26, 2023· Updated Jun 17, 2026

CVE-2023-24422

Description

A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:script-securityMaven	< 1229.v4880b	1229.v4880b

Affected products

ghsa-coords
pkg:maven/org.jenkins-ci.plugins/script-security
Range: < 1229.v4880b
Jenkins Project/Script Securitycpe-rescue2 versions
unspecified+ 1 more
- (no CPE)range: unspecified
- cpe:2.3:a:jenkins:script_security:*:*:*:*:*:jenkins:*:*range: <1229.v4880b_b_e905a_6

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-76qj-9gwh-pvv3ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-24422ghsaADVISORY
www.jenkins.io/security/advisory/2023-01-24/nvdVendor AdvisoryWEB
github.com/jenkinsci/script-security-plugin/commit/4880bbe905a6783d80150c8b881d0127430d4a73ghsaWEB

News mentions

Jenkins Security Advisory 2023-01-24
Jenkins Security Advisories · Jan 24, 2023

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000