-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from the lack of an allowlist enforcement mechanism when loading Groovy files. The pre-patch version of makeClassLoader() used GroovySandbox.createSecureClassLoader() which didn't restrict which Groovy source files could be loaded. The commit introduced GroovySourceFileAllowlist.ClassLoaderImpl to wrap the secure classloader and enforce allowlist checks. The absence of this wrapper in vulnerable versions made arbitrary Groovy file execution possible.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins.workflow:workflow-cps | maven | <= 2689.v434009a | 2692.v76b |
Ongoing coverage of React2Shell