-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the Groovy sandbox's failure to restrict finalize() method overrides. Both SandboxTransformer (from script-security plugin) and SandboxCpsTransformer (from workflow-cps plugin) didn't properly validate() these methods during AST transformation. Attackers could define classes with finalize() methods that would execute outside sandbox constraints. The patches (e.g., adding forbidIfFinalizer checks in visitMethod) and test cases in commits 16c862a/0eb89aa/e1c56eb confirm these were the vulnerable points. The transformers' method processing logic was missing finalizer validation, making these functions the root cause.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins.workflow:workflow-cps | maven | < 2.60 | 2.60 |
| org.jenkins-ci.plugins:script-security | maven | < 1.48 | 1.48 |
A Semantic Attack on Google Gemini - Read the Latest Research