CVE-2017-1000096

Arbitrary code execution due to incomplete sandbox protection: Constructors, instance variable initializers, and instance initializers in Pipeline scripts were not subject to sandbox protection, and could therefore execute arbitrary code. This could be exploited e.g. by regular Jenkins users with the permission to configure Pipelines in Jenkins, or by trusted committers to repositories containing Jenkinsfiles.

• CWE-732

• http://www.securityfocus.com/bid/99571Third Party Advisory, VDB Entry
• https://jenkins.io/security/advisory/2017-07-10/Vendor Advisory
• http://www.securityfocus.com/bid/99571Third Party Advisory, VDB Entry
• https://jenkins.io/security/advisory/2017-07-10/Vendor Advisory

Published

Oct 5, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1000090Role-based Authorization Strategy Plugin was not requiring r…
• CVE-2017-1000091GitHub Branch Source Plugin connects to a user-specified Git…
• CVE-2017-1000092Git Plugin connects to a user-specified Git repository as pa…
• CVE-2017-1000093Poll SCM Plugin was not requiring requests to its API be sen…
• CVE-2017-1000094Docker Commons Plugin provides a list of applicable credenti…
• CVE-2017-1000095The default whitelist included the following unsafe entries:…
• CVE-2017-1000097On Darwin, user's trust preferences for root certificates we…7.5
• CVE-2017-1000098The net/http package's Request.ParseMultipartForm method sta…7.5
• CVE-2017-1000099When asking to get a file from a file:// URL, libcurl provid…
• CVE-2017-10001Vulnerability in the Oracle Hospitality Simphony First Editi…
• CVE-2017-1000100When doing a TFTP transfer and curl/libcurl is given a URL t…6.5
• CVE-2017-1000101curl supports "globbing" of URLs, in which a user can pass a…6.5