Executive brief
Jenkins Script Security Plugin provides a sandbox to safely run user-supplied scripts in Pipelines. A flaw in versions 1415.v9a_f9b_3a_c253d and earlier fails to enforce security checks when scripts perform operations (method calls, property access, array indexing) on null values. Attackers with permission to create or edit Pipelines can exploit this to execute arbitrary code with Jenkins controller privileges.
Technical details
The vulnerability is a sandbox bypass in the Script Security Plugin's Groovy sandbox. The root cause is missing interception of operations on null receivers—method calls, property accesses, attribute accesses, and array accesses performed on null values are not checked. An attacker with pipeline or script definition permissions can craft a sandboxed script that performs these unchecked operations on null to bypass sandbox restrictions and execute arbitrary code in the Jenkins JVM. No authentication is required beyond permission to define and run scripts. The fix is available in version 1422.v06869826dd9b_ or later, which intercepts all operations on null receivers.
Affected products
- Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier
Timeline
- 2026-09-16: disclosed