CVE-2023-24422

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-01-26 · updated 2026-06-17
Weakness: CWE-78

Description

A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Affected products

Jenkins project Jenkins Script Security Plugin: before 1229.v4880b_b_e905a_6 — fixed in 1229.v4880b_b_e905a_6

How to fix

Upgrade to a fixed version: Jenkins project Jenkins Script Security Plugin 1229.v4880b_b_e905a_6. Check the vendor advisory for mitigations.

References

https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-3016
https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-3016

Get alerted when CVE-2023-24422 or the next vulnerability affects your stack