Description
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins Pipeline: Groovy Plugin | 2.63 and earlier | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | jenkins-2-plugins | 3.11.1552336312-1.el7 | RHSA-2019:0739 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Jenkins 2.63 - Sandbox bypass in pipeline: Groovy plug-in EDB-48904 · webapps · Oct 19, 2020
GitHub 2 repositories
-
overgrowncarrot1/CVE-2019-1003030 ★ 1 · Mar 1, 2025
-
cyberbelly/PoC-CVE-2019-1003030 ★ 0 · Jul 11, 2026
PoC for jenkins 2.63 CVE-2019-1003030
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Jenkins Pipeline Groovy Plugin <=2.63 - Insecure Deserialization http/cves/2019/CVE-2019-1003030.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins.workflow:workflow-cps | < 2.64 | 2.64 | GHSA-r6mc-mrvr-23cr |
Advisories 1
- RHSA-2019:0739 Red Hat Security Advisory: Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Nov 22, 2025