Jenkins Templating Engine vulnerabilities

2 CVEs affecting Jenkins Templating Engine, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-31722, published 2025-04-02.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-21646, published 2021-04-21. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. Jenkins Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin, allowing attackers with Job/Configure permission to execute arbitrary code…
• CVE-2025-31722, published 2025-04-02. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. In Jenkins Templating Engine Plugin 2.5.3 and earlier, libraries defined in folders are not subject to sandbox protection, allowing attackers with Item/Configure permission to execute arbitrary code…