GHSA-4vjp-327p-w4qv

Source

https://github.com/advisories/GHSA-4vjp-327p-w4qv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-4vjp-327p-w4qv/GHSA-4vjp-327p-w4qv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4vjp-327p-w4qv

Aliases

CVE-2025-31722

Published

2025-04-02T15:31:38Z

Modified

2025-04-02T23:12:09.287758Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Jenkins Templating Engine Plugin Vulnerable to Arbitrary Code Execution

Details

Jenkins Templating Engine Plugin allows defining libraries both in the global configuration, as well as scoped to folders containing the pipelines using them. While libraries in the global configuration can only be set up by administrators and can therefore be trusted, libraries defined in folders can be configured by users with Item/Configure permission.

In Templating Engine Plugin 2.5.3 and earlier, libraries defined in folders are not subject to sandbox protection. This vulnerability allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.

In Templating Engine Plugin 2.5.4, libraries defined in folders are subject to sandbox protection.

Database specific

{
    "nvd_published_at": "2025-04-02T15:15:59Z",
    "cwe_ids": [
        "CWE-94"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-02T22:39:27Z"
}

References

Affected packages

Maven / org.jenkins-ci.plugins:templating-engine

Package

Name: org.jenkins-ci.plugins:templating-engine; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/templating-engine

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.5.4

Affected versions

1.*

1.0

1.1

1.1.1

1.2

1.3

1.4

1.4.1

1.4.2

1.5

1.5.1

1.5.2

1.6

1.7

1.7.1

2.*

2.0-alpha

2.0-alpha2

2.0

2.0.1

2.0.2

2.0.3

2.0.4

2.1

2.2

2.2.1

2.2.1.1

2.2.2

2.3

2.4

2.5

2.5.1

2.5.2

2.5.3