Jenkins Script Security Plugin version 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member. An attacker who can supply a Groovy script on the component’s classpath can execute code outside the intended sandbox, enabling arbitrary code execution within the Jenkins environment. The flaw is associated with CWE-693 and CWE-93.

The vulnerability affects the Jenkins Project Script Security Plugin at version 1402.v94c9ce464861 and all earlier releases. Systems running Jenkins with this plugin configuration are at risk if they allow untrusted Groovy scripts to be placed on the classpath.

The CVSS score of 7.5 indicates a high severity. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, but the potential for code execution makes it a high‑impact issue. Exploitation requires the attacker to influence the classpath that the plugin uses to load scripts, which is feasible in environments with low control over library directories or with malicious build artifacts. Once the annotation is processed, the attacker can execute outside the sandbox, compromising the entire Jenkins instance or its build nodes.