CVE-2026-57281: Jenkins Script Security Plugin sandbox bypass via Groovy AST annotations

CVE-2026-57281 · Severity: high · CVSS 7.5 · Published 2026-06-24

The Jenkins Script Security Plugin is used to safely run user-provided scripts by restricting them to a 'sandbox' that prevents unauthorized actions. A vulnerability in this plugin allows users with permission to run scripts to bypass these safety restrictions and execute unauthorized code on the Jenkins server. While exploitation requires a specific type of script to already be present on the server's file system, a successful attack could lead to full system compromise.

Technologies: org.jenkins-ci.plugins:script-security (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-57281 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57281 being exploited in the wild.
How severe is CVE-2026-57281?
High severity, with a CVSS score of 7.5, published 24 June 2026.
Which products and versions are affected?
org.jenkins-ci.plugins:script-security (Maven) < 1402.1405.vc96e74964250, ECOSYSTEM:introduced=0,fixed=1402.1405.vc96e74964250.
Is there a fix for CVE-2026-57281?
Yes. org.jenkins-ci.plugins:script-security (Maven): upgrade to 1402.1405.vc96e74964250 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57281 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-57281?
Check whether you run org.jenkins-ci.plugins:script-security (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.jenkins-ci.plugins:script-security (Maven): upgrade to 1402.1405.vc96e74964250 or later
    # set org.jenkins-ci.plugins:script-security to 1402.1405.vc96e74964250 in your pom.xml or build.gradle

Technical details

The Jenkins Script Security Plugin fails to reject Groovy Abstract Syntax Tree (AST) transformation annotations, such as @CompileStatic or @TypeChecked, when they include an 'extensions' member. This member instructs Groovy to load and execute a script from the classpath during the compilation phase, which occurs before the sandbox protections are applied. An attacker with permissions to define and run sandboxed Groovy scripts can exploit this to achieve code execution outside the sandbox, provided a suitable Groovy script is available on the component's classpath. Although the Jenkins security team has not identified default scripts in core or common plugins that facilitate this, the vulnerability is rated High due to the potential for sandbox escape. The issue is resolved in version 1402.1405.vc96e74964250.

Affected products

  • Jenkins Project Script Security Plugin 1402.v94c9ce464861 and earlier

Identifiers

  • CVE-2026-57281
  • GHSA-cfj9-2vgr-hpxp

Timeline

  • 2026-06-24: disclosed
  • 2026-06-24: advisory
  • 2026-06-24: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.