{"action":"Upgrade org.jenkins-ci.main:jenkins-core to 2.138.4 (2.138.x) or 2.154 (2.154.x) or later.","affected":[{"fixed":"2.138.4","introduced":"0"},{"fixed":"2.154","introduced":"2.140"}],"component":"org.jenkins-ci.main:jenkins-core","cve_ids":["CVE-2018-1000861"],"ecosystem":"Maven","epss":0.98326,"exploited":true,"fixed_versions":["2.138.4","2.154"],"ghsa_id":"GHSA-hhpm-5cp2-hg4x","id":"tcs_01M5N90SD7W22YQWRZXZ57BDN6","modified_at":"2025-10-22T19:13:04.438741Z","published_at":"2022-05-13T01:01:00Z","references":["https://osv.dev/vulnerability/GHSA-hhpm-5cp2-hg4x","https://nvd.nist.gov/vuln/detail/CVE-2018-1000861","https://github.com/jenkinsci/jenkins/commit/47f38d714c99e1841fb737ad1005618eb26ed852","https://access.redhat.com/errata/RHBA-2019:0024","https://jenkins.io/security/advisory/2018-12-05/#SECURITY-595","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-1000861","http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html","http://www.securityfocus.com/bid/106176"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-hhpm-5cp2-hg4x","url":"https://osv.dev/vulnerability/GHSA-hhpm-5cp2-hg4x"},{"source":"kev","source_id":"CVE-2018-1000861","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}],"summary":"Deserialization of Untrusted Data in Jenkins"}