Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
☕
☕ Maven
CISA KEV · ACTIVELY EXPLOITED
CRITICAL severity

Sandbox bypass in Jenkins Pipeline: Groovy PluginGHSA-r6mc-mrvr-23cr

CRITICAL

GHSA-r6mc-mrvr-23cr is a critical-severity (CVSS 9.9) CWE-693 vulnerability in org.jenkins-ci.plugins.workflow:workflow-cps. It is in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-25) — treat it as actively exploited and patch now. A fix is available for org.jenkins-ci.plugins.workflow:workflow-cps — see the affected versions and patch details below.

Also known asCVE-2019-1003030
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
5 known
Exploitation data as of Oct 24, 2026 · OSV.dev, NVD, CISA KEV, FIRST.org (EPSS)

Exploitation Status

Actively exploited in the wild

  • Confirmed by CISA's Known Exploited Vulnerabilities catalog on 2022-03-25. Federal agencies were required to remediate by 2022-04-15.
  • A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA (KEV catalog and SSVC triage) for GHSA-r6mc-mrvr-23cr.

EPSS Exploitation Probability

via FIRST.org ↗
97.1%probability of exploitation in next 30 days
Very High Risk0.00%
Lower risk than most CVEs100th percentile — riskier than 100% of all scored CVEsHighest risk
69.2%79.4%89.7%100.0%93.1%97.1%Apr 26Aug 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

GHSA-r6mc-mrvr-23cr by exploitation likelihood (EPSS) against impact (CVSS). In the shaded patch-first corner (EPSS 50%+, CVSS 7.0+).

Where this sits among everything scored

Of 395,249 CVEs with a current EPSS score, this one falls in the ≥ 90% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

1 pkg affected
☕org.jenkins-ci.plugins.workflow:workflow-cps

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.jenkins-ci.plugins.workflow:workflow-cpsall versions2.64org.jenkins-ci.plugins.workflow:workflow-cps:2.64

Affected Products

2 products · 2 configurations
Application
pipeline\jenkins
≤ 2.63
1 version
_groovy
Application
openshift container platformredhat
1 version
3.11
Exploits & PoCs
5

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

EDB-48904webappsjava

Jenkins 2.63 - Sandbox bypass in pipeline: Groovy plug-in

by Daniel Morris · Oct 19, 2020

Exploit-DB Source

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.jenkins-ci.plugins.workflow:workflow-cps, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update org.jenkins-ci.plugins.workflow:workflow-cps to 2.64 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-r6mc-mrvr-23cr is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How to detect GHSA-r6mc-mrvr-23cr

A community-maintained Nuclei template exists for this CVE. You can scan for it directly:

nuclei -id ghsa-r6mc-mrvr-23cr -u https://target
Template
Jenkins Pipeline Groovy Plugin <=2.63 - Insecure Deserialization
Severity
critical
Impact
Low-privilege authenticated users (requiring only Overall/Read) can bypass the Groovy sandbox and execute arbitrary OS commands on the Jenkins controller. This leads to full CI/CD pipeline compromise: credential theft, SSH key extraction, arbitrary node execution, and supply chain attacks via poisoned build artifacts.
Remediation
Upgrade Pipeline: Groovy Plugin (workflow-cps) to version 2.64 or later. If upgrading is not immediately possible, restrict Overall/Read access to trusted users only, or disable Pipeline job creation for untrusted users.

Template by ProjectDiscovery nuclei-templates (princechaddha), MIT licensed. View the full template. Scan only systems you are authorised to test.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant
ProductFixed inAdvisory
Red Hat OpenShift Container Platform 3.11jenkins-2-plugins-0:3.11.1552336312-1.el7RHSA-2019:0739

Frequently Asked Questions

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
O3 Security · Impact-Aware SCA

Is GHSA-r6mc-mrvr-23cr in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works
Sandbox bypass in Jenkins Pipeline: Groovy Plugin