Jenkins Script Security Plugin has a script security bypass vulnerability

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations such as @CompileStatic and @TypeChecked that carry an extensions member, which causes Groovy to load and execute a script from the classpath at compile time, before the sandbox is...

io.jenkins.plugins:createos-sandbox (24.vfe318c36a_db_8), io.jenkins.plugins:gitea-checks (606.679.vb_d632867a_6b_b) +10 more potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1402.v94c9ce464861)

org.jenkins-ci.plugins:script-security MAVEN version 1402.v94c9ce464861 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:createos-sandbox 24.vfe318c36adb8 -...

com.openshift.jenkins.plugins:openshift-client (1.1.0.413.v3023d27e8434), io.jenkins.plugins:openshift-k8s-credentials (104.v4ff06c65eb_f7) +21 more potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1244.ve463715a_f89c)

org.jenkins-ci.plugins:script-security MAVEN version 1244.ve463715af89c is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.openshift.jenkins.plugins:openshift-client 1.1.0.413.v3023d27e8434...

jp.ikedam.jenkins.plugins:extensible-choice-parameter (>=1.4.0, <=1.8.0), org.jenkins-ci.plugins:extended-choice-parameter (0.65) +4 more potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1.18.1)

org.jenkins-ci.plugins:script-security MAVEN version 1.18.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - jp.ikedam.jenkins.plugins:extensible-choice-parameter =1.4.0, =1.2.3, =1.3.4, =1.9...

org.jenkins-ci.plugins:ant-in-workspace (1.2.2), org.jenkins-ci.plugins:applitools-eyes (>=1.14, <=1.15.1) +1 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.75)

org.jenkins-ci.plugins:script-security MAVEN version 1.75 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:ant-in-workspace 1.2.2 - org.jenkins-ci.plugins:applitools-ey...

Jenkins Script Security Plugin sandbox bypass vulnerability

Jenkins Script Security Plugin provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type cast applied to each element of the...

org.jenkins-ci.plugins:applitools-eyes (1.16.4) potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1145.vb_cf6cf6ed960)

org.jenkins-ci.plugins:script-security MAVEN version 1145.vbcf6cf6ed960 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:applitools-eyes 1.16.4 Source cves:...

com.bmc.ims:bmc-cfa (>=198.vfe106798d1a6, <=200.va3bf13f31cdd), com.bmc.ims:bmc-change-manager-imstm (>=81.v560fa_d742db_d, <=83.v761069998a_34) +39 more potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1385.v7d2d9ec4d909)

org.jenkins-ci.plugins:script-security MAVEN version 1385.v7d2d9ec4d909 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.bmc.ims:bmc-cfa =198.vfe106798d1a6, =81.v560fad742dbd, =1.46.0,...

au.com.versent.jenkins.plugins:ignore-committer-strategy (29.v7c3891a_434c3), com.coravy.hudson.plugins.github:github (>=1.41.0, <=1.42.0) +52 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1362.v67dc1f0e1b_b_3)

org.jenkins-ci.plugins:script-security MAVEN version 1362.v67dc1f0e1bb3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - au.com.versent.jenkins.plugins:ignore-committer-strategy...

org.jenkins-ci.plugins:whitesource (20.8.1) potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.66)

org.jenkins-ci.plugins:script-security MAVEN version 1.66 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:whitesource 20.8.1 Source cves: CVE-2026-57281 Source advisor...

de.tracetronic.jenkins.plugins:ecu-test-execution (>=3.0, <=3.4), jp.ikedam.jenkins.plugins:extensible-choice-parameter (1.8.1) potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1158.v7c1b_73a_69a_08)

org.jenkins-ci.plugins:script-security MAVEN version 1158.v7c1b73a69a08 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - de.tracetronic.jenkins.plugins:ecu-test-execution =3.0, =3.4 -...

io.jenkins.plugins:createos-sandbox (24.vfe318c36a_db_8), io.jenkins.plugins:gitea-checks (606.679.vb_d632867a_6b_b) +10 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1402.v94c9ce464861)

org.jenkins-ci.plugins:script-security MAVEN version 1402.v94c9ce464861 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:createos-sandbox 24.vfe318c36adb8 -...

de.taimos:pipeline-aws (>=1.21, <=1.24), org.jenkins-ci.plugins:pipeline-utility-steps (>=2.0, <=2.0.2) potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1.40)

org.jenkins-ci.plugins:script-security MAVEN version 1.40 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - de.taimos:pipeline-aws =1.21, =2.0, =2.0.2 Source cves: CVE-2026-57280 Source...

org.jenkins-ci.plugins.workflow:workflow-cps (>=2.40, <=2.41), org.jenkins-ci.plugins:claim (>=2.10, <=2.15) +3 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.34)

org.jenkins-ci.plugins:script-security MAVEN version 1.34 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-cps =2.40, =2.10, =1.7, =1.2.5, =1.2.5,...

hudson.plugins.octopusdeploy:octopusdeploy (4.0.2), org.jenkins-ci.plugins:badge (>=1.0, <=1.1) +2 more potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1.39)

org.jenkins-ci.plugins:script-security MAVEN version 1.39 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - hudson.plugins.octopusdeploy:octopusdeploy 4.0.2 - org.jenkins-ci.plugins:badge =1.0...

org.jenkins-ci.plugins:extended-choice-parameter (>=0.68, <=0.76) potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1.19)

org.jenkins-ci.plugins:script-security MAVEN version 1.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:extended-choice-parameter =0.68, =0.76 Source cves:...

au.com.versent.jenkins.plugins:ignore-committer-strategy (>=37.v0d3157c4a_ef8, <=63.v7e87d06b_a_30c), com.amazon.jenkins.fleet:ec2-fleet (>=4.1.0.506.v619d63b_ec9d8, <=4.2.1.515.v100267825939) +130 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1369.v9b_98a_4e95b_2d)

org.jenkins-ci.plugins:script-security MAVEN version 1369.v9b98a4e95b2d is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - au.com.versent.jenkins.plugins:ignore-committer-strategy...

de.esailors.jenkins:test-stability (2.4), io.jenkins.blueocean:blueocean-rest-impl (>=1.27.17, <=1.27.18) +20 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1335.vf07d9ce377a_e)

org.jenkins-ci.plugins:script-security MAVEN version 1335.vf07d9ce377ae is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - de.esailors.jenkins:test-stability 2.4 -...

org.jenkins-ci.plugins:ant-in-workspace (1.2.2), org.jenkins-ci.plugins:applitools-eyes (>=1.14, <=1.15.1) +1 more potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1.75)

org.jenkins-ci.plugins:script-security MAVEN version 1.75 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:ant-in-workspace 1.2.2 - org.jenkins-ci.plugins:applitools-ey...

org.jenkins-ci.plugins:webhook-step (327.vb_58f208a_7783) potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1281.v22fb_899df1a_e)

org.jenkins-ci.plugins:script-security MAVEN version 1281.v22fb899df1ae is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:webhook-step 327.vb58f208a7783 Source cves:...