# CVE-2019-1003029: Sandbox bypass in Script Security Plugin

Source: https://junglewise.ai/threats/cve-2019-1003029-jenkins-script-security-plugin-sandbox-bypass-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-13. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2019-1003029 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2022-05-13

A sandbox bypass vulnerability in the Jenkins Script Security Plugin allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM. The flaw exists in the GroovySandbox.java and SecureGroovyScript.java components due to a protection mechanism failure.

Technologies: [Jenkins Script Security Plugin](https://junglewise.ai/threats/technologies/script-security-plugin), [org.jenkins-ci.plugins:script-security (Maven)](https://junglewise.ai/threats/technologies/org-jenkins-ci-plugins-script-security). Vendors: [Jenkins](https://junglewise.ai/threats/vendors/jenkins), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2019-1003029 exploited in the wild?** Yes. CVE-2019-1003029 is known to be exploited in the wild, first recorded on 25 April 2022. Treat it as urgent.

**How severe is CVE-2019-1003029?** Critical severity, with a CVSS score of 3.1, published 13 May 2022.

**Which products and versions are affected?** org.jenkins-ci.plugins:script-security (Maven) ECOSYSTEM:introduced=0,fixed=1.54.

**Is there a fix for CVE-2019-1003029?** Yes. org.jenkins-ci.plugins:script-security (Maven): upgrade to 1.54 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-1003029 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2019-1003029?** Check whether you run Jenkins Script Security Plugin or org.jenkins-ci.plugins:script-security (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.jenkins-ci.plugins:script-security (Maven): upgrade to 1.54 or later

  ```sh
  # set org.jenkins-ci.plugins:script-security to 1.54 in your pom.xml or build.gradle
  ```


## Affected products

- Jenkins Project Script Security Plugin 1.53 and earlier

## Identifiers

- CVE-2019-1003029
- GHSA-xvxq-hq48-xphm

## Timeline

- 2019-03-06: disclosed: Vendor advisory SECURITY-1336 published.
- 2022-04-25: kev added: Added to CISA Known Exploited Vulnerabilities Catalog.
- 2022-04-25: advisory: NVD publication date.

## Related threats

- [Jenkins Script Security Plugin sandbox bypass with dynamic methods](https://junglewise.ai/threats/cve-2026-92129-jenkins-script-security-plugin-sandbox-bypass-with-dynamic)
- [Jenkins Script Security Plugin arbitrary JAR loading via double download](https://junglewise.ai/threats/cve-2026-92128-jenkins-script-security-plugin-arbitrary-jar-loading-via-double)
- [Jenkins Script Security Plugin classpath approval bypass](https://junglewise.ai/threats/cve-2026-92127-jenkins-script-security-plugin-classpath-approval-bypass)
- [Jenkins Script Security Plugin sandbox bypass via @Builder annotation](https://junglewise.ai/threats/cve-2026-92126-jenkins-script-security-plugin-sandbox-bypass-via-builder)
- [Jenkins Script Security Plugin sandbox bypass via @GroovyASTTransformationClass](https://junglewise.ai/threats/cve-2026-92125-jenkins-script-security-plugin-sandbox-bypass-via)