Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
jenkinsci/workflow-cps-plugin
master @ 605fe1d
43
Fixes
0
CVEs
CRITICAL
Peak severity
Highlights
Sandbox Escape: 25 prior fixes. Scrutinize any change in this area.
lib/src/main/java/com/cloudbees/groovy/cps/SandboxCpsTransformer.java: most-fixed (3 issues). Treat as high-risk during review.
36 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Sandbox Escape: The CPS transformer is a key target where standard compiler fallbacks or un-sandboxed parent execution blocks, such as raw cast expressions or non-CPS methods, frequently allow users to escape sandbox containment entirely.
Auth Bypass: Replay and rebuild workflows can allow unauthorized users to execute unsandboxed scripts on the controller if permissions are not strictly validated or if script security checks are bypassed.
Sandbox Escape: Transient modifiers or failure to persist the pipeline execution sandbox state across restarts or distributed replicas causes sandboxed pipelines to resume in an un-sandboxed, high-privilege execution environment.