{"id":"CVE-2020-2166","details":"Jenkins Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.","aliases":["GHSA-w598-25hm-jqx3"],"modified":"2026-07-09T00:13:34.468209Z","published":"2020-03-25T17:15:15.467Z","references":[{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2020/03/25/2"},{"type":"ADVISORY","url":"https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1741"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jenkinsci/pipeline-aws-plugin","events":[{"introduced":"0"},{"last_affected":"bf4c6bfcc65628d5ce0f8e9f545193907b4861b9"}],"database_specific":{"cpe":"cpe:2.3:a:jenkins:pipeline\\:_aws_steps:*:*:*:*:*:jenkins:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"1.40"}],"source":"CPE_RANGE"}}],"versions":["pipeline-aws-1.40","pipeline-aws-1.39","pipeline-aws-1.38","pipeline-aws-1.37","pipeline-aws-1.36","pipeline-aws-1.35","pipeline-aws-1.34","pipeline-aws-1.33","pipeline-aws-1.32","pipeline-aws-1.31","pipeline-aws-1.30","pipeline-aws-1.29","pipeline-aws-1.28","pipeline-aws-1.27","pipeline-aws-1.26","pipeline-aws-1.25","pipeline-aws-1.24","pipeline-aws-1.23","pipeline-aws-1.22","pipeline-aws-1.21","pipeline-aws-1.20","pipeline-aws-1.19","pipeline-aws-1.18","pipeline-aws-1.17","pipeline-aws-1.16","pipeline-aws-1.15","pipeline-aws-1.14","pipeline-aws-1.13","pipeline-aws-1.12","pipeline-aws-1.11","pipeline-aws-1.10","pipeline-aws-1.9","pipeline-aws-1.8","pipeline-aws-1.7","pipeline-aws-1.6","pipeline-aws-1.5","pipeline-aws-1.4","pipeline-aws-1.3","pipeline-aws-1.2","pipeline-aws-1.1","pipeline-aws-1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-2166.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}