-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| cprice404:pipeline-classpath | maven | = 0.1.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the classpath step functionality that enables adding classpath entries during pipeline execution. Since the advisory specifically mentions this plugin enables sandbox bypass, the core function responsible for processing classpath additions (ClasspathStepExecution.run) would be the entry point that fails to properly validate/restrict classpath sources. This would allow users with SCM commit access to load unapproved libraries containing unsafe methods that escape the Groovy sandbox. The high confidence comes from the direct correlation between the plugin's purpose (classpath manipulation) and the described sandbox bypass mechanism.
JavaJavaOngoing coverage of React2Shell