The Jenkins Script Security Plugin does not intercept implicit type casts applied to elements of typed for‑each loops in sandboxed Groovy scripts, allowing an attacker who can supply such scripts to invoke arbitrary constructors and bypass sandbox protection. This flaw permits execution of arbitrary code within the Jenkins environment, compromising confidentiality, integrity, and availability of the affected system.

Jenkins Project Jenkins Script Security Plugin versions 1402.v94c9ce464861 and earlier are vulnerable. All installations using these or earlier versions of the plugin are impacted.

An attacker who can provide Groovy scripts to the affected system can exploit this weakness to execute arbitrary constructors, effectively breaking the intended sandbox controls. The CVSS score is not disclosed; EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits yet. However, the ability to bypass the sandbox indicates a high potential for exploitation on systems where Groovy scripting is enabled.