Remote code execution vulnerability in Jenkins Templating Engine Plugin

HIGH 8.8CVE-2021-21646 · GHSA-p6qc-37hq-wqr6 · Published 21/04/2021 · updated 17/06/2026

In short

CVE-2021-21646 is a HIGH (CVSS 8.8) vulnerability affecting org.jenkins-ci.plugins:templating-engine, templating engine (jenkins).
Chance of exploitation in the next 30 days (EPSS): 1.7%, higher than 77.9% of all vulnerabilities.
Fix: update to 2.2 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:templating-engine Maven	`< 2.2`	`2.2`
templating engine jenkins	`≤ 2.1`	No fix yet

Description

Jenkins Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin.

This vulnerability allows attackers with Job/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.

Jenkins Templating Engine Plugin 2.2 integrates with Script Security Plugin to protect its pipeline configurations.

NVD description

Jenkins Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin, allowing attackers with Job/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.

References

nvd.nist.gov/vuln/detail/CVE-2021-21646 · ADVISORY
jenkinsci/templating-engine-plugin commit aed14be · WEB
jenkinsci/templating-engine-plugin · PACKAGE
jenkins.io/security/advisory/2021-04-21 · WEB
openwall.com/lists/oss-security/2021/04/21/2 · WEB

More vulnerabilities in org.jenkins-ci.plugins:templating-engine

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:templating-engine

Maven

< 2.2

2.2

templating engine

jenkins

≤ 2.1

No fix yet

Description

Jenkins Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin.

This vulnerability allows attackers with Job/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.

Jenkins Templating Engine Plugin 2.2 integrates with Script Security Plugin to protect its pipeline configurations.

NVD description