CVE-2020-2158: 
Java vulnerability analysis and mitigation

Jenkins Literate Plugin version 1.0 and earlier contains a remote code execution vulnerability (CVE-2020-2158) discovered and disclosed on March 9, 2020. The vulnerability affects the YAML parser configuration in the plugin, which fails to prevent the instantiation of arbitrary types (Jenkins Advisory, OSS Security).

The vulnerability exists because the Literate Plugin does not properly configure its YAML parser to prevent the instantiation of arbitrary types. This configuration weakness allows for remote code execution when processing YAML input files provided to the plugin's build step (Jenkins Advisory). The severity is rated as High according to the CVSS scoring system (OSS Security).

The vulnerability enables remote code execution that can be exploited by users who have the ability to provide YAML input files to the Literate Plugin's build step. This allows attackers to execute arbitrary code in the context of the Jenkins environment (Jenkins Advisory).

As of the publication of the security advisory on March 9, 2020, no fix was available for this vulnerability. Users of the Literate Plugin version 1.0 and earlier should assess their risk and consider discontinuing use of the plugin until a security fix is available (Jenkins Advisory).