A sandbox bypass vulnerability in Jenkins ontrack Plugin 3.4 and earlier allowed attackers with control over ontrack DSL definitions to execute arbitrary code on the Jenkins master JVM.

Affected Packages

Maven org.jenkins-ci.plugins:ontrack

Affected versions: 0 (fixed in 3.4.1)

Related CVEs

CVE-2019-10306

Key Information

GHSA ID

GHSA-qw28-g63m-jxqv

Published

May 24, 2022 4:43 PM

Last Modified

September 9, 2022 12:51 AM

CVSS Score

9.0 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.plugins:ontrack

GitHub Reviewed

✓ Yes

Dataset

Last updated: August 27, 2025 6:31 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.