Executive brief
Jenkins Script Security Plugin is a sandbox feature that prevents malicious scripts from accessing dangerous operations. The plugin fails to restrict certain code decorators (@Builder annotations) that can be used to instantiate arbitrary classes during script compilation, bypassing the sandbox protection. An attacker with permission to define scripts in Jenkins (such as Pipeline authors) can exploit this to run arbitrary code with Jenkins controller privileges.
Technical details
This is a sandbox bypass vulnerability (CWE-693) in the Jenkins Script Security Plugin. The root cause is insufficient validation of @Builder annotations during Groovy script compilation. Groovy's @Builder annotation can specify a custom builderStrategy class that is instantiated at compile time, before the sandbox is applied. The plugin fails to reject @Builder annotations with arbitrary builderStrategy values, allowing an attacker to instantiate arbitrary classes during compilation. An attacker must have permission to define and execute sandboxed scripts (e.g., Jenkinsfile Pipeline). The fix (version 1422.v06869826dd9b_ and later) validates and rejects @Builder annotations with untrusted builderStrategy classes during sandbox compilation.
Affected products
- Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Version 1422.v06869826dd9b_ and later