Executive brief
Jenkins Script Security Plugin is a sandboxing feature that allows running user-provided scripts safely by restricting dangerous operations. A vulnerability in versions 1415 and earlier allows attackers with permission to define and run scripts (including Pipelines) to bypass this sandbox protection entirely by using the @GroovyASTTransformationClass annotation, leading to arbitrary code execution on the Jenkins controller with full JVM privileges.
Technical details
The vulnerability is a sandbox bypass caused by insufficient validation of the @GroovyASTTransformationClass annotation during script compilation. An attacker can declare an annotation type linked to an arbitrary AST transformation via this annotation, causing Groovy to execute that transformation at compile time—before the sandbox is applied. This allows arbitrary code execution in the Jenkins controller JVM context. The attack requires the attacker to already have permission to define and run sandboxed scripts. The fix (Script Security Plugin 1422.v06869826dd9b_) rejects the @GroovyASTTransformationClass annotation during sandbox compilation, preventing Groovy from resolving or executing the referenced transformation.
Affected products
- Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier
Timeline
- 2026-09-16: disclosed: Jenkins Security Advisory published
- 2026-09-16: other: Fixed in Script Security Plugin 1422.v06869826dd9b_