Jenkins Script Security Plugin has a script security bypass vulnerability
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations such as @CompileStatic and @TypeChecked that carry an extensions member, which causes Groovy to load and execute a script from the classpath at compile time, before the sandbox is applied.
This may allow attackers able to define and run sandboxed scripts to execute code outside the sandbox, in the rare case that a suitable Groovy script is present on the classpath of the component that evaluates the script.
The Jenkins security team has been unable to identify any Groovy source files in Jenkins core or plugins that would allow attackers to execute dangerous code. While the severity of this issue is declared as High due to the potential impact, successful exploitation is considered very unlikely.
Script Security Plugin 1402.1405.vc96e74964250 rejects any annotation carrying an extensions member during sandbox compilation, before Groovy can resolve or execute the referenced script.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.jenkins-ci.plugins:script-security | < 1402.1405.vc96e74964250 | 1402.1405.vc96e74964250 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-57281
- https://github.com/jenkinsci/script-security-plugin/commit/c96e7496425031182b6fc11ef1c55b9ae4fa7cc2
- https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57281.json
- https://github.com/jenkinsci/script-security-plugin/releases/tag/1402.1405.vc96e74964250
- https://github.com/jenkinsci/script-security-plugin
- https://bugzilla.redhat.com/show_bug.cgi?id=2492200
- https://access.redhat.com/security/cve/CVE-2026-57281
- https://access.redhat.com/errata/RHSA-2026:60259
- https://access.redhat.com/errata/RHSA-2026:60256
- https://access.redhat.com/errata/RHSA-2026:60254
- https://access.redhat.com/errata/RHSA-2026:60252
- https://access.redhat.com/errata/RHSA-2026:60251
- https://access.redhat.com/errata/RHSA-2026:60250
- https://access.redhat.com/errata/RHSA-2026:60249
- https://access.redhat.com/errata/RHSA-2026:60248
- https://access.redhat.com/errata/RHSA-2026:60247
- https://access.redhat.com/errata/RHSA-2026:60246
- https://access.redhat.com/errata/RHSA-2026:60239
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-917, CWE-93- Platform
- Java / Kotlin (Maven)
- Package
org.jenkins-ci.plugins:script-security- Disclosed
- 24.06.2026
- Updated
- 11.10.2026 13:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-cfj9-2vgr-hpxp - CC BY 4.0
Vulnerability history: org.jenkins-ci.plugins:script-security
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 37
- First → latest
- 05.2022 06.2026
- Without a fix
- 0
- Exploited in attacks
- 1
Severity breakdown
- Critical 5
- High 22
- Medium 10
Disclosures per year
- 2022: 30
- 2023: 1
- 2024: 3
- 2025: 0
- 2026: 3
-
Jenkins Script Security Plugin has a script security bypass vulnerability this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.