RCE vulnerability in Jenkins Pipeline: AWS Steps Plugin

HIGH 8.8CVE-2020-2166 · GHSA-w598-25hm-jqx3 · Published 25/03/2020 · updated 17/06/2026

In short

CVE-2020-2166 is a HIGH (CVSS 8.8) vulnerability affecting de.taimos:pipeline-aws, pipeline (jenkins).
Chance of exploitation in the next 30 days (EPSS): 2.0%, higher than 81.1% of all vulnerabilities.
Fix: update to 1.41 or later.

Package	Affected versions	Patched versions
de.taimos:pipeline-aws Maven	`< 1.41`	`1.41`
pipeline jenkins	`≤ 1.40`	No fix yet

Description

Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution (RCE) vulnerability exploitable by users able to provide YAML input files to Pipeline: AWS Steps Plugin’s build steps.

Pipeline: AWS Steps Plugin 1.41 configures its YAML parser to only instantiate safe types.

NVD description

Jenkins Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2020-2166 · ADVISORY
jenkinsci/pipeline-aws-plugin · PACKAGE
jenkins.io/security/advisory/2020-03-25 · WEB
openwall.com/lists/oss-security/2020/03/25/2 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free