A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
CVE-2019-1003000
HIGHNVD 8.89.0▲Trending — 3 sources updated this weekWeaponized
EchelonGraph scoreHIGH confidence
Score elevated to 9.0 because EPSS predicts 98% probability of exploitation within the next 30 days (top 0.1% of all CVEs). NVD baseline CVSS 8.8 retained for reference. Confidence: see factors.
Triggered by: EPSS exploit prediction ≥85%
Sources: epss, nvd
8.8
EchelonGraph verdictPatch this weekExploitation is likely or a public exploit exists.
- High exploitation likelihood — EPSS 98%
CISA-KEV: Not listedEPSS: 98%CVSS: 8.8Exploit: NoneExposed: 0
A fix is available — apply it.
- CVSS v3
- 8.8
- EG Score
- 9.0(high)
- EG Risk
- 84(Track)EG Risk 84/100SSVC: Track
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
How it’s computedSeverity90% × 45%Exploitation98% × 40%Automatability30% × 15%Action: Routine — remediate on your standard cadence. - EPSS
- 99.9%
- KEV
- Not listed
Published
January 22, 2019
Last Modified
November 21, 2024
References (14)
- jenkinsci-cert@googlegroupshttp://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html
- jenkinsci-cert@googlegroupshttp://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming
- jenkinsci-cert@googlegroupshttps://access.redhat.com/errata/RHBA-2019:0326
- jenkinsci-cert@googlegroupshttps://access.redhat.com/errata/RHBA-2019:0327
- jenkinsci-cert@googlegroupshttps://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266
- jenkinsci-cert@googlegroupshttps://www.exploit-db.com/exploits/46453/
- jenkinsci-cert@googlegroupshttps://www.exploit-db.com/exploits/46572/
- af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html
- af854a3a-2127-422b-91ae-364da2661108http://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming
- af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHBA-2019:0326
- af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHBA-2019:0327
- af854a3a-2127-422b-91ae-364da2661108https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266
- af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/46453/
- af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/46572/
Vendor Advisories for CVE-2019-1003000(1)
These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.
Patch Availability(1)
| Vendor / Ecosystem | Fixed in / Patch | Released | Source |
|---|---|---|---|
| redhat | openshift-enterprise-cluster-capacity-0:3.11.82-1.git.380.cf11c51.el7 | 2019-02-20 | redhat |
Patches are aggregated from vendor advisories (Red Hat, Microsoft, Cisco, GitHub) and package ecosystems (OSV, GHSA). Multiple rows for the same upstream release have been deduplicated.
Affected Packages
(1 across 1 ecosystem)
Maven(1)
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| org.jenkins-ci.plugins:script-security | 1.0 ... 1.9 (59 versions) | 1.50 | — |
Data Freshness Timeline
(refreshed 8× in last 7d / 14× in last 30d)
Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.
- 2026-07-23 01:38 UTCEG score recompute
- 2026-07-22 22:18 UTCEG score recompute
- 2026-07-22 14:05 UTCEPSS rescore
- 2026-07-20 23:32 UTCOSV refresh
- 2026-07-19 14:28 UTCEPSS rescore
- 2026-07-19 14:28 UTCEPSS rescore
- 2026-07-16 16:59 UTCEPSS rescore
- 2026-07-16 16:59 UTCEPSS rescore
- 2026-07-15 16:55 UTCEPSS rescore
- 2026-07-12 05:43 UTCEPSS rescore
- 2026-07-09 19:06 UTCEPSS rescore
- 2026-07-04 06:28 UTCEPSS rescore
- 2026-07-04 06:28 UTCEPSS rescore
- 2026-07-03 18:56 UTCOSV refresh
- 2026-06-15 17:45 UTCEPSS rescore
- 2026-06-15 07:13 UTCOSV refresh
- 2026-05-29 13:41 UTCEPSS rescore
- 2026-05-27 23:05 UTCEG score recompute
- 2026-05-27 23:05 UTCVendor advisory
Publicly available exploits
(8 references)Working exploit code is in the public domain (1 Metasploit module) (3 GitHub PoCs) (3 Exploit-DB entries). Defenders should treat patch urgency accordingly — public PoCs typically lead to mass-exploitation within 24-72 hours.
- GitHub PoC1NTheKut/CVE-2019-1003000_RCE-DETECTIONFirst seen Apr 24, 2019
A C# module to detect if a Jenkins server is vulnerable to the RCE vulnerability found in CVE-2019-1003000 (chained with CVE-2018-1000861 for pre-auth RCE)
Open source ↗ - Exploit-DBEDB-46572✓ verifiedFirst seen Mar 19, 2019
Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming Remote Code Execution (Metasploit)
Open source ↗ - Exploit-DBEDB-46453First seen Feb 25, 2019
Jenkins Plugin Script Security 1.49/Declarative 1.3.4/Groovy 2.60 - Remote Code Execution
Open source ↗ - Exploit-DBEDB-46427✓ verifiedFirst seen Feb 19, 2019
Jenkins Plugin Script Security < 1.50/Declarative < 1.3.4.1/Groovy < 2.61.1 - Remote Code Execution (PoC)
Open source ↗ - GitHub PoCadamyordan/cve-2019-1003000-jenkins-rce-pocFirst seen Feb 15, 2019
Jenkins RCE Proof-of-Concept: SECURITY-1266 / CVE-2019-1003000 (Script Security), CVE-2019-1003001 (Pipeline: Groovy), CVE-2019-1003002 (Pipeline: Declarative)
Open source ↗ - Metasploitexploit/multi/http/jenkins_metaprogramming✓ verifiedFirst seen Jan 8, 2019
Jenkins ACL Bypass and Metaprogramming RCE
Open source ↗ - Nucleihttp/cves/2019/CVE-2019-1003000.yamlFirst seen Jan 1, 2019
Jenkins Script Security Plugin <=1.49 - Sandbox Bypass
Open source ↗ - GitHub PoCwetw0rk/Exploit-DevelopmentFirst seen Apr 26, 2017
CVE-2020-8012, CVE-2016-10709, CVE-2017-17099, CVE-2017-18047, CVE-2019-1003000, CVE-2018-1999002
Open source ↗
Frequently asked(5)
What is CVE-2019-1003000?
CVE-2019-1003000 is a high vulnerability published on January 22, 2019. A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
When was CVE-2019-1003000 disclosed?
CVE-2019-1003000 was first published in the National Vulnerability Database on January 22, 2019, with the most recent update on November 21, 2024. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2019-1003000 actively exploited?
CVE-2019-1003000 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 99.9% percentile likelihood of exploitation in the next 30 days — higher percentiles indicate greater predicted risk.
What is the CVSS score of CVE-2019-1003000?
CVE-2019-1003000 has a CVSS v3 base score of 8.8 (NVD). EchelonGraph synthesises NVD + CISA KEV + FIRST EPSS + GHSA into a combined EG score of 9.0.
How do I remediate CVE-2019-1003000?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2019-1003000, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.
Dependency Blast Radius
See which npm, PyPI, Go, and Maven packages are affected by CVE-2019-1003000
Is Your Infrastructure Affected by CVE-2019-1003000?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.