The Jenkins Pipeline Groovy Plugin does not restrict the Java types that can be instantiated through the Pipeline Snippet Generator, which allows an attacker to create objects of classes related to job or system configuration instead of normal Pipeline steps. This weakness can enable an attacker to modify job definitions or alter system settings, potentially leading to unauthorized configuration changes or arbitrary code execution if malicious classes are instantiated. The flaw represents a CWE‑470 type of vulnerability involving insecure type instantiation.

Jenkins Pipeline Groovy Plugin versions 4331.v9d06ed4658ff and earlier are affected. Users should check the installed plugin version and plan an upgrade to a later release that limits the classes that can be created through the Snippet Generator.

The CVSS score of 4.3 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The attack route involves interacting with the Pipeline Snippet Generator, which typically requires user authentication and appropriate permissions within Jenkins; hence it is inferred that an authenticated user with at least view or build rights could exploit the flaw, but the description does not explicitly confirm this. The lack of type restrictions provides a defined path for configuration tampering or possible code execution, though such outcomes are not explicitly stated in the advisory and are noted as a likely consequence.