CVE-2020-2279

CRITICAL

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed scripts to provide crafted return values or script binding con...

Affects 1 product across 1 vendor.

CVSS 3.19.9
EPSS2.1%
Percentile82th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
◆ AI Analysis — automated analysis, not human-reviewed

A critical vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed scripts to execute arbitrary code on the Jenkins controller JVM.

BSID: BS-2020-GLOBAL-149719-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2020-2279?
A critical vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed scripts to execute arbitrary code on the Jenkins controller JVM.
What is the CVSS score for CVE-2020-2279?
CVE-2020-2279 has CVSS 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS: 2.1%.
Is CVE-2020-2279 actively exploited?
No confirmed active exploitation of CVE-2020-2279 as of 2026-09-25.
How do I remediate CVE-2020-2279?
Priority: IMMEDIATE. Advisory: https://www.jenkins.io/security/advisory/2020-09-23/#SECURITY-2020 PSIRT: [email protected]
What systems are affected by CVE-2020-2279?
CVE-2020-2279 affects Jenkins Script Security.
Vulnerability Details
CVE IDCVE-2020-2279
BSIDBS-2020-GLOBAL-149719-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published2020-09-23
Last Modified2026-06-17
ICS Relevance0%
Domains
CLOUD
SourceNVD
Official Description

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed scripts to provide crafted return values or script binding content that can result in arbitrary code execution on the Jenkins controller JVM.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Attackers can craft return values or script binding content in sandboxed scripts to bypass the security sandbox and execute arbitrary code on the Jenkins controller JVM.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Jenkins Script Security ≤ 1.74
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2213 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash0e6ab73333927720705f93fb7f6f8ca0c976469a52abad6d4a41eeb535cbe6512a6137d5c103f272f37e10de8bb005f937254204015726da7e8f6da0bbce9b7e
Related CVEs affecting Jenkins
CVE-2019-10431 9.9 A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and ear... CVE-2019-10418 9.9 Jenkins Kubernetes :: Pipeline :: Arquillian Steps Plugin provides a custom w... CVE-2019-1003031 9.9 A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 a... CVE-2022-43401 9.9 A sandbox bypass vulnerability involving various casts performed implicitly b... CVE-2022-43402 9.9 A sandbox bypass vulnerability involving various casts performed implicitly b...
View all Jenkins CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.9 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →