---
layout: security
title: "Handling Vulnerabilities in Plugins"
section: security
---


We strive to fix all security vulnerabilities in Jenkins and plugins in a timely manner.
However, the structure of the Jenkins project, which gives plugin maintainers a lot of autonomy, and the number and diversity of plugins make this impossible to guarantee.

[[unresolved]]
== Announcing Unresolved Vulnerabilities

In case of a plugin vulnerability, we try to contact the plugin maintainer(s) to inform them of it.
If they decline (or otherwise fail) to fix the vulnerability, or don't respond in a timely manner, and the security team doesn't have the capacity to fix it, we follow the process outlined below in the interest of our users:

. Publish a security advisory about the plugin, describing the nature of the vulnerability, but noting that there is no fix (other than no longer using the plugin).
  If there are workarounds, explain them.
. In some cases of particularly severe vulnerabilities, link:#suspensions[stop publishing the vulnerable plugin on the Jenkins update sites].
. Add metadata to update sites to inform administrators on the Jenkins UI about vulnerable plugins they have installed.
. Display security warnings on https://plugins.jenkins.io/[the plugins site].

This allows Jenkins administrators to make an informed decision about their continued use of plugins with unresolved security vulnerabilities.

[[followup]]
== Following Up Later

Some maintainers end up fixing security vulnerabilities after we have announced it as unresolved in their plugin.
This can be any time between hours and years after publication.

In those cases, security advisories will _not_ be amended, as the information provided was correct at the time of publication.
Additionally, the security advisory will be clear that the lack of a fix is only known "_as of publication of this advisory_".

We will update the security warnings metadata that is shown to administrators in Jenkins and on https://plugins.jenkins.io/[the plugins site].
Maintainers can inform us through Jira or email about a fix or https://github.com/jenkins-infra/update-center2/#security-warnings[file a pull request updating the warnings metadata] themselves.
Once we confirm the fix is correct and complete, we will update the published warnings metadata.
This will remove the active security warning from the plugin entry on the plugins site and from the plugin manager directly in Jenkins.

[[suspensions]]
== Suspended Plugins

Distribution of the following plugins was suspended in conjunction with the publication of a security advisory announcing unresolved security issues.
The Jenkins security team believes that most use cases would be negatively impacted by these security vulnerabilities and it is better for the Jenkins ecosystem to no longer distribute these plugins in their current form to prevent harm to users.
This typically is the case when plugins have particularly severe security vulnerabilities, deliberately bypass or disable protection mechanisms, or offer little benefit to users anyway.

* 360 FireLine (`fireline`): link:/security/advisory/2022-10-19/#SECURITY-2866[SECURITY-2866]
* Adaptive DSL (`AdaptivePlugin`): link:/security/advisory/2017-04-10/#adaptive-dsl-plugin[SECURITY-457]
* Autocomplete Parameter (`autocomplete-parameter`): link:/security/advisory/2022-05-17/[multiple vulnerabilities announced on 2022-05-17]
* Azure CLI (`azure-cli`): link:/security/advisory/2025-10-29/#SECURITY-3538[SECURITY-3538]
* Build Flow (`build-flow-plugin`): link:/security/advisory/2017-04-10/#build-flow-plugin[SECURITY-293]
* CAS protocol version 1 (`cas1`): link:/security/advisory/2017-04-10/#cas-protocol-version-1-plugin[SECURITY-491]
* Config Rotator (`config-rotator`): link:/security/advisory/2022-11-15/#SECURITY-2842[SECURITY-2842]
* Copy To Slave (`copy-to-slave`): link:/security/advisory/2018-03-26/#SECURITY-545[SECURITY-545]
* CryptoMove (`cryptomove`): link:/security/advisory/2020-03-09/#SECURITY-1635[SECURITY-1635]
* CVS Tagging (`cvs-tag`): link:/security/advisory/2017-04-10/#cvs-tagging-plugin[SECURITY-459]
* Debian Package Builder (`debian-package-builder`): link:/security/advisory/2022-01-12/#SECURITY-2546[SECURITY-2546]
* DotCi (`DotCi`): link:/security/advisory/2022-09-21/#SECURITY-1737[SECURITY-1737]
* Dynamic Parameter (`dynamicparameter`): link:/security/advisory/2017-04-10/#dynamic-parameter-plugin[SECURITY-462]
* ElasticBox Jenkins Kubernetes CI/CD (`kubernetes-ci`): link:/security/advisory/2020-07-02/#SECURITY-1738[SECURITY-1738]
* Grails (`grails`): link:/security/advisory/2017-04-10/#grails-plugin[SECURITY-458]
* GroovyAxis (`groovyaxis`): link:/security/advisory/2017-04-10/#groovyaxis-plugin[SECURITY-460]
* JS Games (`jsgames`): link:/security/advisory/2020-09-01/#SECURITY-1905[SECURITY-1905]
* Kubernetes Continuous Deploy (`kubernetes-cd`): link:/security/advisory/2022-08-23/#SECURITY-2448[SECURITY-2448]
* Kubernetes :: Pipeline :: Arquillian Steps (`kubernetes-pipeline-arquillian-steps`): link:/security/advisory/2019-09-25/#SECURITY-920%20(2)[SECURITY-920 (2)]
* Kubernetes :: Pipeline :: Kubernetes Steps (`kubernetes-pipeline-steps`): link:/security/advisory/2019-09-25/#SECURITY-920%20(1)[SECURITY-920 (1)]
* Literate (`literate`): link:/security/advisory/2020-03-09/#SECURITY-1750[SECURITY-1750]
* Mashup Portlets (`mashup-portlets-plugin`): link:/security/advisory/2023-03-21/#SECURITY-2813[SECURITY-2813]
* Nerrvana (`nerrvana`): link:/security/advisory/2020-10-08/#SECURITY-2097[SECURITY-2097]
* Persona (`persona`): link:/security/advisory/2020-10-08/#SECURITY-2046[SECURITY-2046]
* Pipeline: Classpath Step (`pipeline-classpath`): link:/security/advisory/2017-03-20/#pipeline-classpath-step-plugin-allowed-script-security-sandbox-bypass[SECURITY-336]
* Pipeline: Phoenix AutoTest (`phoenix-autotest`): link:/security/advisory/2022-03-29/[multiple vulnerabilities announced on 2022-03-29]
* Puppet Enterprise Pipeline (`puppet-enterprise-pipeline`): link:/security/advisory/2019-10-16/#SECURITY-918[SECURITY-918]
* Reactor (`reactor`): link:/security/advisory/2017-04-10/#reactor-plugin[SECURITY-487]
* `remote-jobs-view-plugin`: link:/security/advisory/2023-03-21/#SECURITY-2956[SECURITY-2956]
* Script SCM (`scriptscm`): link:/security/advisory/2017-04-10/#script-scm-plugin[SECURITY-461]
* `scripttrigger`: link:/security/advisory/2017-04-10/#scripttrigger-plugin[SECURITY-456]
* Simple Travis Pipeline Runner (`simple-travis-runner`): link:/security/advisory/2019-08-07/#SECURITY-922[SECURITY-922]
* Chef Sinatra (`sinatra-chef-builder`): link:/security/advisory/2022-02-15/#SECURITY-1377[SECURITY-1377]
* ScreenRecorder (`screenrecorder`): link:/security/advisory/2022-10-19/#SECURITY-2864[SECURITY-2864]
* Speaks! (`speaks`): link:/security/advisory/2017-10-11/#arbitrary-code-execution-vulnerability-in-speaks-plugin[SECURITY-623]
* Storable Configs (`storable-configs-plugin`): link:/security/advisory/2022-05-17/#SECURITY-1969[SECURITY-1969], link:/security/advisory/2020-09-16/[multiple vulnerabilities announced on 2020-09-16]
* Subversion Tagging (`svn-tag`): link:/security/advisory/2017-04-10/#subversion-tagging-plugin[SECURITY-298]
* `tcl`: link:/security/advisory/2017-04-10/#tcl-plugin[SECURITY-379]
* Team Views (`team-views`): link:/security/advisory/2022-02-15/[multiple vulnerabilities announced on 2022-02-15]
* WSO2 Oauth (`wso2id-oauth`): link:/security/advisory/2025-05-14/#SECURITY-3481[SECURITY-3481]
* XFramium Builder (`xframium`): link:/security/advisory/2022-10-19/#SECURITY-2863[SECURITY-2863]

Unless the security issue is inherent to what the plugin does while not making this the sole _purpose_ of the plugin, the Jenkins security team welcomes efforts to fix the vulnerabilities and have plugin distribution restored.

In addition to plugins suspended for security reasons, the following plugins that require suspended plugins to run are also suspended, as they would not be installable:

* Build Automation Management Tool (`build-configurator`) depends on `copy-to-slave`
* `build-flow-extensions-plugin` depends on `build-flow-plugin`
* `build-flow-test-aggregator` depends on `build-flow-plugin`
* `build-flow-toolbox-plugin` depends on `build-flow-plugin`
* DotCi DockerPublish (`DotCi-DockerPublish`) depends on `DotCi`
* DotCi Fig template (`DotCi-Fig-template`) depends on `DotCi-InstallPackages`
* DotCi InstallPackages (`DotCi-InstallPackages`) depends on `DotCi`
* DotCiInstallPackages (`DotCiInstallPackages`) depends on `DotCi`
* External Resource Dispatcher (`externalresource-dispatcher`) depends on `build-flow-plugin`
* Kubernetes :: Pipeline :: Aggregator (`kubernetes-pipeline-aggregator`) depends on `kubernetes-pipeline-arquillian-steps` and `kubernetes-pipeline-steps`
* `lsf-cloud` depends on `copy-to-slave`
* SGE Cloud Plugin (`sge-cloud-plugin`) depends on `copy-to-slave`
* XTrigger (`xtrigger`) depends on `scripttrigger`

////
These plugins are excluded from this page, as the security issue wasn't the reason for suspension, but only triggered it:
azure-slave-plugin
bart
build-publisher
cons3rt
gcm-notification
osf-builder-suite-xml-linter
perforce
play-autotest-plugin
reviewboard - depends on perforce
squashtm-publisher
walti
xltestview-plugin
////
