Script security bypass vulnerability in Jenkins Shared Library Version Override Plugin
Jenkins Shared Library Version Override Plugin 17.v786074c9fce7 and earlier declares folder-scoped library overrides as trusted, so that they're not executed in the Script Security sandbox, allowing attackers with Item/Configure permission on a folder to configure a folder-scoped library override that runs without sandbox protection. This allows attackers with Item/Configure permission on a folder to configure a folder-scoped library override that runs without sandbox protection. Shared Library Version Override Plugin 19.v3a_c975738d4a_ declares folder-scoped library overrides as untrusted, so that they’re executed in the Script Security sandbox.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | io.jenkins.plugins:shared-library-version-override | < 19.v3a | 19.v3a |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-862- Platform
- Java / Kotlin (Maven)
- Package
io.jenkins.plugins:shared-library-version-override- Disclosed
- 13.11.2024
- Updated
- 11.10.2026 12:21
Sources and licenses
OSV / GitHub Advisory Database - GHSA-7845-crfj-phc4 - CC BY 4.0
Vulnerability history: io.jenkins.plugins:shared-library-version-override
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.