Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
jenkinsci/pipeline-groovy-lib-plugin
master @ 89408fa
6
Fixes
0
CVEs
HIGH
Peak severity
50.0%
Coverage
Highlights
Path Traversal: 2 prior fixes. Scrutinize any change in this area.
cps-global-lib: most-fixed (2 issues). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Sandbox Escape: User-defined library scripts could previously bypass the Groovy sandbox execution model. Malicious pipeline code could append arbitrary directories or URLs directly to the trusted Groovy shell loader, granting full system access. Ensure library loading always binds scripts to the trusted Groovy shell context.
Path Traversal: The library resource retriever failed to validate underlying symbolic links pointing outside the workspace boundary. This allowed unprivileged pipeline scripts to retrieve sensitive files on the master controller. Symlink validation and target resolution must be explicitly performed before file operations.
Path Traversal: Weak path canonicalization on Windows filesystems allowed 8.3 filename aliases and case-insensitive paths to bypass prefix checks. Standard path comparisons must always canonicalize paths beforehand to prevent unauthorized directory access.