CVE-2022-43401

CRITICAL

A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with...

Affects 1 product across 1 vendor.

CVSS 3.19.9
EPSS1.3%
Percentile70th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
◆ AI Analysis — automated analysis, not human-reviewed

A critical vulnerability in the Jenkins Script Security Plugin allows attackers to bypass the sandbox and execute arbitrary code.

BSID: BS-2022-GLOBAL-334776-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2022-43401?
A critical vulnerability in the Jenkins Script Security Plugin allows attackers to bypass the sandbox and execute arbitrary code.
What is the CVSS score for CVE-2022-43401?
CVE-2022-43401 has CVSS 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS: 1.3%.
Is CVE-2022-43401 actively exploited?
No confirmed active exploitation of CVE-2022-43401 as of 2026-09-25.
How do I remediate CVE-2022-43401?
Priority: IMMEDIATE. Advisory: https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%281%29 PSIRT: [email protected]
What systems are affected by CVE-2022-43401?
CVE-2022-43401 affects Jenkins Script Security.
Vulnerability Details
CVE IDCVE-2022-43401
BSIDBS-2022-GLOBAL-334776-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published2022-10-19
Last Modified2026-06-17
ICS Relevance0%
Domains
CLOUD
SourceNVD
Official Description

A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Attackers with permission to define and run sandboxed scripts can exploit implicit casts in the Groovy language runtime to bypass security restrictions.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Jenkins Script Security ≤ 1183.v774b_0b_0a_a_451
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1457 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashe6a325c22e15b76e494437c2281f86e219006630e95c9257e33f2bd61e0263c6580d35214870b79f44e6546a588bf84e0551f30b3150208d18bce8d58400c227
Related CVEs affecting Jenkins
CVE-2019-10431 9.9 A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and ear... CVE-2019-10418 9.9 Jenkins Kubernetes :: Pipeline :: Arquillian Steps Plugin provides a custom w... CVE-2019-1003031 9.9 A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 a... CVE-2020-2279 9.9 A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and ear... CVE-2022-43402 9.9 A sandbox bypass vulnerability involving various casts performed implicitly b...
View all Jenkins CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.9 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →