CVE-2026-57281

jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox

View on CVE.org
Published Jun 24, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Description
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.

Analysis

AI-generated

Technical impact

Jenkins Script Security Plugin version 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member. An attacker who can supply a Groovy script on the component’s classpath can execute code outside the intended sandbox, enabling arbitrary code execution within the Jenkins environment. The flaw is associated with CWE-693, CWE-917, and CWE-93.

Affected Systems

The vulnerability affects the Jenkins Project Script Security Plugin at version 1402.v94c9ce464861 and all earlier releases. Systems running Jenkins with this plugin configuration are at risk if they allow untrusted Groovy scripts to be placed on the classpath.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, but the potential for code execution makes it a high‑impact issue. Exploitation requires the attacker to influence the classpath that the plugin uses to load scripts, which is feasible in environments with low control over library directories or with malicious build artifacts. Once the annotation is processed, the attacker can execute outside the sandbox, compromising the entire Jenkins instance or its build nodes. The flaw is associated with CWE-693, CWE-917, and CWE-93.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Jenkins Script Security Plugin to a version newer than 1402.v94c9ce464861, which contains a fix that properly rejects annotations with an extensions member.
  • If an immediate upgrade is not possible, configure Jenkins to exclude untrusted directories from the Groovy classpath or remove any custom Groovy scripts that may contain AST transformation annotations.
  • As a temporary measure, disable the script sandbox for trusted users and monitor for any changes to classpath‑loaded scripts, then revert to sandboxed execution once a permanent patch is applied.

Generated by OpenCVE AI on June 25, 2026 at 13:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-cfj9-2vgr-hpxp Jenkins Script Security Plugin has a script security bypass vulnerability
History
Type Values Removed Values Added
Title Jenkins Script Security Plugin AST Transformation Annotation Bypass Allows Sandbox Escape jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox
Weaknesses CWE-917
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
First Time appeared Jenkins Project
Jenkins Project jenkins Script Security Plugin
Vendors & Products Jenkins Project
Jenkins Project jenkins Script Security Plugin
Type Values Removed Values Added
Title Jenkins Script Security Plugin AST Transformation Annotation Bypass Allows Sandbox Escape
Type Values Removed Values Added
Title Groovy AST Transformation Annotation Exploits Sandbox in Jenkins Script Security Plugin
Type Values Removed Values Added
Title Groovy AST Transformation Annotation Code Injection in Jenkins Script Security Plugin Groovy AST Transformation Annotation Exploits Sandbox in Jenkins Script Security Plugin
Weaknesses CWE-94
Type Values Removed Values Added
Title Groovy AST Transformation Annotation Code Injection in Jenkins Script Security Plugin
Weaknesses CWE-94
Type Values Removed Values Added
Weaknesses CWE-693
CWE-93
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.
References
Earlier changes (5)
Weaknesses
  • CWE-693

    Protection Mechanism Failure

  • CWE-917

    Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

  • CWE-93

    Improper Neutralization of CRLF Sequences ('CRLF Injection')

Sources

Status
PUBLISHED
Assigner
jenkins
Published
Updated
Sep 7, 2026, 12:05 PM
Reserved
Jun 24, 2026, 8:41 AM

View source JSON

Updated
Sep 7, 2026, 12:05 PM

JSON

Status
Modified
Published
Jun 24, 2026, 2:17 PM
Modified
Oct 25, 2026, 11:10 PM

View source JSON

Severity
Important
Public date
Jun 24, 2026, 1:20 PM

View source Bugzilla JSON

Updated
Jun 25, 2026, 2:00 PM

JSON