Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

jenkinsci/email-ext-plugin

              main @ a71e9f4
            

Fixes

CVEs

HIGH

Peak severity

60.0%

Coverage

Highlights

Sandbox Escape: 4 prior fixes. Scrutinize any change in this area.

src/main/java/hudson/plugins/emailext/ExtendedEmailPublisher.java: most-fixed (2 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Sandbox Escape: Attackers can bypass sandbox restrictions during template script parsing and initialization, allowing arbitrary JVM code execution. Scripts must be run utilizing the standard GroovySandbox scope wrapper without exposing raw constructor executions.

Sandbox Escape: Execution of email templates processed via SimpleTemplateEngine bypassed secure sandbox boundaries. Safe script evaluation requires integrating with the Jenkins script-security framework and wrapping execution blocks.

Auth Bypass: The lack of rigorous, administrator-configured permission checks allowed low-privilege users to execute and test privileged templates or validation flows. Proper permission enforcement such as Jenkins.MANAGE is required.