Jenkins project Jenkins Script Security Plugin vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Jenkins project Jenkins Script Security Plugin: 4 record(s), with affected versions and fixes.
CVE-2026-57281
High · 7.5
CWE-93 Jun 24, 2026
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST…
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.
CVE-2026-57280
High · 8.8
CWE-693 Jun 24, 2026
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the…
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection.
CVE-2026-42519
Medium · 4.3
CWE-862 Apr 29, 2026
Missing Authorization in Jenkins Script Security
A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths.
CVE-2019-1003029
Critical · 9.9
KEV Urgent · 72 Public exploit Mar 8, 2019
Jenkins Script Security Plugin Sandbox Bypass Vulnerability
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.