CVE-2026-57281
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk44th percentile — higher than 44% of all known CVEs
Summary
Jenkins Script Security Plugin version 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.
Risk Assessment
The organization faces a risk of remote code execution (RCE) by an attacker with permissions to run sandboxed scripts, potentially leading to full compromise of the Jenkins server and access to sensitive data.
Recommendation
It is recommended to immediately update the Script Security Plugin to a version later than 1402.v94c9ce464861, which fixes this vulnerability, and restrict script execution access to trusted users only.
Original NVD description (English source)
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.