Executive brief
Jenkins Script Security Plugin provides a sandbox that restricts Groovy scripts to safe operations, protecting Jenkins controllers from arbitrary code execution. A vulnerability in versions 1415.v9a_f9b_3a_c253d and earlier allows attackers with permission to write sandboxed scripts (including Pipeline jobs) to bypass sandbox checks during type casting of collections, enabling arbitrary code execution on the Jenkins server itself. This impacts any Jenkins instance allowing users to author Pipelines or Groovy-based scripts.
Technical details
This is a sandbox bypass vulnerability in the Script Security Plugin's type-casting logic. When Groovy casts a collection to another type, the plugin checks operations on individual elements but then performs the cast on the collection object itself rather than on the checked elements. An attacker can override collection methods to supply different elements during the actual cast, bypassing sandbox inspection. The vulnerability affects Script Security Plugin versions through 1415.v9a_f9b_3a_c253d and requires the attacker to have permission to define and execute sandboxed scripts (Pipeline jobs, script execution steps, etc.). The fix in version 1422.v06869826dd9b_ performs the cast on the same elements that were checked, closing the bypass. No public exploitation has been reported, but the ease of exploitation for authorized users is high.
Affected products
- Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Fixed in Script Security Plugin 1422.v06869826dd9b_