Executive brief
The Jenkins Script Security Plugin is a tool used to safely run user-provided scripts by restricting them to a 'sandbox' environment. A vulnerability in this plugin allows an attacker with the ability to provide scripts (such as in a Pipeline) to bypass these safety restrictions. By exploiting this flaw, an attacker can execute unauthorized commands on the Jenkins controller, potentially leading to a full system takeover and access to sensitive build data.
Technical details
A sandbox bypass vulnerability exists in the Jenkins Script Security Plugin due to improper interception of implicit type casts. In sandboxed Groovy scripts, typed for-each loops (e.g., 'for (Type t in collection)') perform type casting during bytecode generation rather than in the transformed Abstract Syntax Tree (AST). Because the plugin failed to intercept these specific casts, an attacker can craft a script that invokes arbitrary constructors. This bypasses the sandbox's security checks, allowing for arbitrary code execution on the Jenkins controller. The issue is resolved in version 1402.1405.vc96e74964250 by updating the groovy-sandbox library.
Affected products
- Jenkins Project Script Security Plugin 1402.v94c9ce464861 and earlier
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
- 2026-06-24: patched