All vulnerabilities
CVE-2026-57281GHSA-cfj9-2vgr-hpxp

org.jenkins-ci.plugins:script-security: Jenkins Script Security Plugin has a script security bypass vulnerability

Jenkins Project org.jenkins-ci.plugins:script-securitymavenApplications & CMS
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.92%Chance of exploitation activity in the next 30 days, higher than 60% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1402.1405.vc96e74964250Fixed versionGitHub
Published24 Jun 2026Updated 25 Sep 2026CVE List

What fixes it

  • 1402.1405.vc96e74964250org.jenkins-ci.plugins:script-security, mavenGitHub<dependency><groupId>org.jenkins-ci.plugins</groupId><artifactId>script-security</artifactId><version>1402.1405.vc96e74964250</version></dependency>
  • 1402.1405.vc96e74964250org.jenkins-ci.plugins:script-security, MavenOSV<dependency><groupId>org.jenkins-ci.plugins</groupId><artifactId>script-security</artifactId><version>1402.1405.vc96e74964250</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations such as @CompileStatic and @TypeChecked that carry an extensions member, which causes Groovy to load and execute a script from the classpath at compile time, before the sandbox is applied.

This may allow attackers able to define and run sandboxed scripts to execute code outside the sandbox, in the rare case that a suitable Groovy script is present on the classpath of the component that evaluates the script.

The Jenkins security team has been unable to identify any Groovy source files in Jenkins core or plugins that would allow attackers to execute dangerous code. While the severity of this issue is declared as High due to the potential impact, successful exploitation is considered very unlikely.

Script Security Plugin 1402.1405.vc96e74964250 rejects any annotation carrying an extensions member during sandbox compilation, before Groovy can resolve or execute the referenced script.

Text from GitHub Advisory Database

Affected versions 53

  • org.jenkins-ci.plugins:script-security, maven< 1402.1405.vc96e74964250GitHub
  • Jenkins Script Security Pluginaffected: all versions through 1402.v94c9ce464861CVE List
  • org.jenkins-ci.plugins:script-security, Mavenfrom first release, fixed in 1402.1405.vc96e74964250OSV
  • org.jenkins-ci.plugins:script-security, Maven1.0OSV
  • org.jenkins-ci.plugins:script-security, Maven1.0-beta-1OSV
  • org.jenkins-ci.plugins:script-security, Maven1.0-beta-2OSV
  • org.jenkins-ci.plugins:script-security, Maven1.0-beta-3OSV
  • org.jenkins-ci.plugins:script-security, Maven1.0-beta-4OSV
  • org.jenkins-ci.plugins:script-security, Maven1.0-beta-5OSV
  • org.jenkins-ci.plugins:script-security, Maven1.0-beta-6OSV
  • org.jenkins-ci.plugins:script-security, Maven1.1OSV
  • org.jenkins-ci.plugins:script-security, Maven1.10OSV
  • org.jenkins-ci.plugins:script-security, Maven1.11OSV
  • org.jenkins-ci.plugins:script-security, Maven1.12OSV
  • org.jenkins-ci.plugins:script-security, Maven1.13OSV
  • org.jenkins-ci.plugins:script-security, Maven1.14OSV
  • org.jenkins-ci.plugins:script-security, Maven1.15OSV
  • org.jenkins-ci.plugins:script-security, Maven1.16OSV
  • org.jenkins-ci.plugins:script-security, Maven1.17OSV
  • org.jenkins-ci.plugins:script-security, Maven1.18OSV
  • org.jenkins-ci.plugins:script-security, Maven1.18.1OSV
  • org.jenkins-ci.plugins:script-security, Maven1.19OSV
  • org.jenkins-ci.plugins:script-security, Maven1.2OSV
  • org.jenkins-ci.plugins:script-security, Maven1.20OSV
  • org.jenkins-ci.plugins:script-security, Maven1.21OSV
  • org.jenkins-ci.plugins:script-security, Maven1.22OSV
  • org.jenkins-ci.plugins:script-security, Maven1.23OSV
  • org.jenkins-ci.plugins:script-security, Maven1.24OSV
  • org.jenkins-ci.plugins:script-security, Maven1.25OSV
  • org.jenkins-ci.plugins:script-security, Maven1.26OSV
  • org.jenkins-ci.plugins:script-security, Maven1.27OSV
  • org.jenkins-ci.plugins:script-security, Maven1.28OSV
  • org.jenkins-ci.plugins:script-security, Maven1.29OSV
  • org.jenkins-ci.plugins:script-security, Maven1.29.1OSV
  • org.jenkins-ci.plugins:script-security, Maven1.3OSV
  • org.jenkins-ci.plugins:script-security, Maven1.30OSV
  • org.jenkins-ci.plugins:script-security, Maven1.31OSV
  • org.jenkins-ci.plugins:script-security, Maven1.33OSV
  • org.jenkins-ci.plugins:script-security, Maven1.34OSV
  • org.jenkins-ci.plugins:script-security, Maven1.35OSV
  • org.jenkins-ci.plugins:script-security, Maven1.36OSV
  • org.jenkins-ci.plugins:script-security, Maven1.37OSV
  • org.jenkins-ci.plugins:script-security, Maven1.38OSV
  • org.jenkins-ci.plugins:script-security, Maven1.39OSV
  • org.jenkins-ci.plugins:script-security, Maven1.4OSV
  • org.jenkins-ci.plugins:script-security, Maven1.40OSV
  • org.jenkins-ci.plugins:script-security, Maven1.41OSV
  • org.jenkins-ci.plugins:script-security, Maven1.42OSV
  • org.jenkins-ci.plugins:script-security, Maven1.43OSV
  • org.jenkins-ci.plugins:script-security, Maven1.44OSV
  • org.jenkins-ci.plugins:script-security, Maven1.44.1OSV
  • org.jenkins-ci.plugins:script-security, Maven1.45OSV
  • org.jenkins-ci.plugins:script-security, Maven1.46OSV

References 19