CVE-2022-43403

CRITICAL

A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define...

Affects 1 product across 1 vendor.

CVSS 3.19.9
EPSS1.6%
Percentile75th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
◆ AI Analysis — automated analysis, not human-reviewed

A critical vulnerability in the Jenkins Script Security Plugin allows attackers to bypass the sandbox and execute arbitrary code on the Jenkins controller JVM.

BSID: BS-2022-GLOBAL-334778-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2022-43403?
A critical vulnerability in the Jenkins Script Security Plugin allows attackers to bypass the sandbox and execute arbitrary code on the Jenkins controller JVM.
What is the CVSS score for CVE-2022-43403?
CVE-2022-43403 has CVSS 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS: 1.6%.
Is CVE-2022-43403 actively exploited?
No confirmed active exploitation of CVE-2022-43403 as of 2026-09-25.
How do I remediate CVE-2022-43403?
Priority: IMMEDIATE. Advisory: https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%281%29 PSIRT: [email protected]
What systems are affected by CVE-2022-43403?
CVE-2022-43403 affects Jenkins Script Security.
Vulnerability Details
CVE IDCVE-2022-43403
BSIDBS-2022-GLOBAL-334778-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published2022-10-19
Last Modified2026-06-17
ICS Relevance0%
Domains
CLOUD
SourceNVD
Official Description

A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability involves casting an array-like value to an array type, which can be exploited by attackers with permission to define and run sandboxed scripts, such as Pipelines.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Jenkins Script Security ≤ 1183.v774b_0b_0a_a_451
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1457 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashb2ed52bb3cb640a5ab50c2b2a314352ae745493d81b4510446490358011aa677526eac510dd34348349a9983dba06982b7cc71a9af5e74494ffd483e438f617a
Related CVEs affecting Jenkins
CVE-2019-10431 9.9 A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and ear... CVE-2019-10418 9.9 Jenkins Kubernetes :: Pipeline :: Arquillian Steps Plugin provides a custom w... CVE-2019-1003031 9.9 A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 a... CVE-2020-2279 9.9 A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and ear... CVE-2022-43402 9.9 A sandbox bypass vulnerability involving various casts performed implicitly b...
View all Jenkins CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.9 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →