All vulnerabilities
CVE-2026-57280GHSA-c3jm-9vj7-5v66

org.jenkins-ci.plugins:script-security: Jenkins Script Security Plugin sandbox bypass vulnerability

Jenkins Project org.jenkins-ci.plugins:script-securitymavenApplications & CMS
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.51%Chance of exploitation activity in the next 30 days, higher than 42% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1402.1405.vc96e74964250Fixed versionGitHub
Published24 Jun 2026Updated 25 Sep 2026CVE List

What fixes it

  • 1402.1405.vc96e74964250org.jenkins-ci.plugins:script-security, mavenGitHub<dependency><groupId>org.jenkins-ci.plugins</groupId><artifactId>script-security</artifactId><version>1402.1405.vc96e74964250</version></dependency>
  • 1402.1405.vc96e74964250org.jenkins-ci.plugins:script-security, MavenOSV<dependency><groupId>org.jenkins-ci.plugins</groupId><artifactId>script-security</artifactId><version>1402.1405.vc96e74964250</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Jenkins Script Security Plugin provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations.

Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type cast applied to each element of the iterated collection in a typed for loop (e.g. for (Type t in collection)), as this cast is performed during bytecode generation rather than in the transformed script AST.

This allows attackers able to provide sandboxed scripts to invoke constructors of arbitrary types without those invocations being checked by the sandbox, bypassing the sandbox protection. This can be used to execute arbitrary code on the Jenkins controller.

Script Security Plugin 1402.1405.vc96e74964250 updates the bundled groovy-sandbox library to a version that intercepts the implicit type cast applied to typed for loop elements, so those casts are checked by the sandbox.

Text from GitHub Advisory Database

Affected versions 53

  • org.jenkins-ci.plugins:script-security, maven< 1402.1405.vc96e74964250GitHub
  • Jenkins Script Security Pluginaffected: all versions through 1402.v94c9ce464861CVE List
  • org.jenkins-ci.plugins:script-security, Mavenfrom first release, fixed in 1402.1405.vc96e74964250OSV
  • org.jenkins-ci.plugins:script-security, Maven1.0OSV
  • org.jenkins-ci.plugins:script-security, Maven1.0-beta-1OSV
  • org.jenkins-ci.plugins:script-security, Maven1.0-beta-2OSV
  • org.jenkins-ci.plugins:script-security, Maven1.0-beta-3OSV
  • org.jenkins-ci.plugins:script-security, Maven1.0-beta-4OSV
  • org.jenkins-ci.plugins:script-security, Maven1.0-beta-5OSV
  • org.jenkins-ci.plugins:script-security, Maven1.0-beta-6OSV
  • org.jenkins-ci.plugins:script-security, Maven1.1OSV
  • org.jenkins-ci.plugins:script-security, Maven1.10OSV
  • org.jenkins-ci.plugins:script-security, Maven1.11OSV
  • org.jenkins-ci.plugins:script-security, Maven1.12OSV
  • org.jenkins-ci.plugins:script-security, Maven1.13OSV
  • org.jenkins-ci.plugins:script-security, Maven1.14OSV
  • org.jenkins-ci.plugins:script-security, Maven1.15OSV
  • org.jenkins-ci.plugins:script-security, Maven1.16OSV
  • org.jenkins-ci.plugins:script-security, Maven1.17OSV
  • org.jenkins-ci.plugins:script-security, Maven1.18OSV
  • org.jenkins-ci.plugins:script-security, Maven1.18.1OSV
  • org.jenkins-ci.plugins:script-security, Maven1.19OSV
  • org.jenkins-ci.plugins:script-security, Maven1.2OSV
  • org.jenkins-ci.plugins:script-security, Maven1.20OSV
  • org.jenkins-ci.plugins:script-security, Maven1.21OSV
  • org.jenkins-ci.plugins:script-security, Maven1.22OSV
  • org.jenkins-ci.plugins:script-security, Maven1.23OSV
  • org.jenkins-ci.plugins:script-security, Maven1.24OSV
  • org.jenkins-ci.plugins:script-security, Maven1.25OSV
  • org.jenkins-ci.plugins:script-security, Maven1.26OSV
  • org.jenkins-ci.plugins:script-security, Maven1.27OSV
  • org.jenkins-ci.plugins:script-security, Maven1.28OSV
  • org.jenkins-ci.plugins:script-security, Maven1.29OSV
  • org.jenkins-ci.plugins:script-security, Maven1.29.1OSV
  • org.jenkins-ci.plugins:script-security, Maven1.3OSV
  • org.jenkins-ci.plugins:script-security, Maven1.30OSV
  • org.jenkins-ci.plugins:script-security, Maven1.31OSV
  • org.jenkins-ci.plugins:script-security, Maven1.33OSV
  • org.jenkins-ci.plugins:script-security, Maven1.34OSV
  • org.jenkins-ci.plugins:script-security, Maven1.35OSV
  • org.jenkins-ci.plugins:script-security, Maven1.36OSV
  • org.jenkins-ci.plugins:script-security, Maven1.37OSV
  • org.jenkins-ci.plugins:script-security, Maven1.38OSV
  • org.jenkins-ci.plugins:script-security, Maven1.39OSV
  • org.jenkins-ci.plugins:script-security, Maven1.4OSV
  • org.jenkins-ci.plugins:script-security, Maven1.40OSV
  • org.jenkins-ci.plugins:script-security, Maven1.41OSV
  • org.jenkins-ci.plugins:script-security, Maven1.42OSV
  • org.jenkins-ci.plugins:script-security, Maven1.43OSV
  • org.jenkins-ci.plugins:script-security, Maven1.44OSV
  • org.jenkins-ci.plugins:script-security, Maven1.44.1OSV
  • org.jenkins-ci.plugins:script-security, Maven1.45OSV
  • org.jenkins-ci.plugins:script-security, Maven1.46OSV

References 5