CVE-2026-92125

A flaw was found in the Jenkins Script Security Plugin. Attackers with permissions to define and run sandboxed scripts, such as Pipelines, can exploit this vulnerability. By not properly rejecting the @GroovyASTTransformationClass annotation, an attacker can run an arbitrary Abstract Syntax Tree...

Arbitrary Code Injection

Overview org.jenkins-ci.plugins:script-security is a package that allows Jenkins administrators to control what in-process scripts can be run by less-privileged users. Affected versions of this package are vulnerable to Arbitrary Code Injection in the @GroovyASTTransformationClass annotation...

CVE-2026-92125

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to run an arbitrary AST transformation at compile time, bypassing the sandbox...

CVE-2026-92125

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to run an arbitrary AST transformation at compile time, bypassing the sandbox...

EUVD-2026-80749

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to run an arbitrary AST transformation at compile time, bypassing the sandbox...

CVE-2026-92125

The Jenkins Script Security Plugin (version 1415.v9a_f9b_3a_c253d and earlier) is vulnerable to a sandbox bypass because it fails to reject the @GroovyASTTransformationClass annotation. An attacker with permissions to define and run sandboxed scripts, such as Pipelines , can use this annotation t...

CVE-2026-92125

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to run an arbitrary AST transformation at compile time, bypassing the sandbox...

PT-2026-93768

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d Description The plugin fails to reject the @GroovyASTTransformationClass annotation. This allows users with permissions to define and execute sandboxed scripts, such as...

Sandbox bypass vulnerability in script-security

script-security provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. script-security 1415.v9af9b3ac253d and earlier does not reject the @GroovyASTTransformationClass annotation, which a script can use to link an...