CVE-2026-57281
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
Jenkins Script Security Plugin version 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.
Risk Assessment
The risk is the potential bypass of the sandbox mechanism and execution of unauthorized code on the Jenkins server, which could lead to system compromise, data theft, or further attacks on the infrastructure.
Recommendation
It is recommended to immediately update the Script Security Plugin to a version later than 1402.v94c9ce464861, which includes a fix for this vulnerability.
Other vulnerabilities in Jenkins Script Security Plugin
See all- CVE-2026-84659Unknown
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding.
- CVE-2026-84658Unknown
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration.
- CVE-2016-3102High
The Script Security plugin in Jenkins before version 1.18.1 may allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugin that performs direct field access or get/set array operations.
Original NVD description (English source)
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.