org.jenkins-ci.plugins.workflow:workflow-aggregator (>=0.1-beta-8, <=1.0), org.jenkins-ci.plugins.workflow:workflow-cps (>=0.1-beta-8, <=1.0) +2 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.9)

org.jenkins-ci.plugins:script-security MAVEN version 1.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator =0.1-beta-8, =0.1-beta-8,...

org.jenkins-ci.plugins.workflow:workflow-cps (>=2.40, <=2.41), org.jenkins-ci.plugins:claim (>=2.10, <=2.15) +3 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.34)

org.jenkins-ci.plugins:script-security MAVEN version 1.34 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-cps =2.40, =2.10, =1.7, =1.2.5, =1.2.5,...

com.openshift.jenkins.plugins:openshift-client (1.1.0.424.v829cb_ccf8798), io.jenkins.plugins:openshift-k8s-credentials (>=168.v79a_983191991, <=276.v708b_2cd34a_9e) +7 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1313.v7a_6067dc7087)

org.jenkins-ci.plugins:script-security MAVEN version 1313.v7a6067dc7087 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.openshift.jenkins.plugins:openshift-client 1.1.0.424.v829cbccf8798...

com.openshift.jenkins:openshift-pipeline (>=1.0.14, <=1.0.57), org.jenkins-ci.plugins.workflow:workflow-aggregator (>=1.10-beta-1, <=1.13) +20 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.15)

org.jenkins-ci.plugins:script-security MAVEN version 1.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.openshift.jenkins:openshift-pipeline =1.0.14, =1.10-beta-1, =1.10-beta-1,...

io.jenkins.blueocean:blueocean (>=1.0.0-b25, <=1.1.7), io.jenkins.blueocean:blueocean-dashboard (>=1.0.0-b25, <=1.0.1) +25 more potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1.26)

org.jenkins-ci.plugins:script-security MAVEN version 1.26 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.blueocean:blueocean =1.0.0-b25, =1.0.0-b25, =1.0.0-b25, =1.0.0-b25,...

com.lookout.jenkins:environment-script (100.v3a_f1a_6a_b_7549), com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer (>=2.4.2, <=2.5.2) +38 more potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1229.v4880b_b_e905a_6)

org.jenkins-ci.plugins:script-security MAVEN version 1229.v4880bbe905a6 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.lookout.jenkins:environment-script 100.v3af1a6ab7549 -...

com.openshift.jenkins.plugins:openshift-client (>=1.1.0.420.v8817277c1990, <=1.1.0.422.va_241c0c97580), com.paul8620.jenkins.plugins:pipeline-aggregator-view (104.v94a_e5f6cdb_c3) +45 more potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1251.vfe552ed55f8d)

org.jenkins-ci.plugins:script-security MAVEN version 1251.vfe552ed55f8d is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.openshift.jenkins.plugins:openshift-client =1.1.0.420.v8817277c199...

hudson.plugins.octopusdeploy:octopusdeploy (4.0.2), org.jenkins-ci.plugins:badge (>=1.0, <=1.1) +2 more potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1.39)

org.jenkins-ci.plugins:script-security MAVEN version 1.39 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - hudson.plugins.octopusdeploy:octopusdeploy 4.0.2 - org.jenkins-ci.plugins:badge =1.0...

Jenkins Script Security Plugin sandbox bypass vulnerability

Jenkins Script Security Plugin provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type cast applied to each element of the...

GHSA-WP5X-HRRW-6R4G Jenkins Git client Plugin has an OS command injection vulnerability on agents

Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded into the SSH wrapper script generated by the "Manually provided keys" Git Host Key Verification strategy on Unix agents. This allows attackers able to control the name of a build...

org.jvnet.hudson.plugins:groovy-postbuild (>=2.0, <=2.2.2) potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.5)

org.jenkins-ci.plugins:script-security MAVEN version 1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jvnet.hudson.plugins:groovy-postbuild =2.0, =2.2.2 Source cves: CVE-2026-57281...

Jenkins Script Security Plugin has a script security bypass vulnerability

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations such as @CompileStatic and @TypeChecked that carry an extensions member, which causes Groovy to load and execute a script from the classpath at compile time, before the sandbox is...

org.jenkins-ci.plugins.workflow:workflow-aggregator (>=0.1-beta-5, <=0.1-beta-7), org.jenkins-ci.plugins.workflow:workflow-cps (>=0.1-beta-5, <=0.1-beta-7) +4 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.6)

org.jenkins-ci.plugins:script-security MAVEN version 1.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator =0.1-beta-5, =0.1-beta-5,...

com.openshift.jenkins.plugins:openshift-client (1.1.0.424.v829cb_ccf8798), io.jenkins.plugins:openshift-k8s-credentials (>=168.v79a_983191991, <=276.v708b_2cd34a_9e) +7 more potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1313.v7a_6067dc7087)

org.jenkins-ci.plugins:script-security MAVEN version 1313.v7a6067dc7087 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.openshift.jenkins.plugins:openshift-client 1.1.0.424.v829cbccf8798...

org.jenkins-ci.plugins:whitesource (20.8.1) potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1.66)

org.jenkins-ci.plugins:script-security MAVEN version 1.66 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:whitesource 20.8.1 Source cves: CVE-2026-57280 Source advisor...

com.bmc.ims:bmc-cfa (>=198.vfe106798d1a6, <=200.va3bf13f31cdd), com.bmc.ims:bmc-change-manager-imstm (>=81.v560fa_d742db_d, <=83.v761069998a_34) +40 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1385.v7d2d9ec4d909)

org.jenkins-ci.plugins:script-security MAVEN version 1385.v7d2d9ec4d909 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.bmc.ims:bmc-cfa =198.vfe106798d1a6, =81.v560fad742dbd, =1.46.0,...

com.openshift.jenkins.plugins:openshift-client (1.1.0.413.v3023d27e8434), io.jenkins.plugins:openshift-k8s-credentials (104.v4ff06c65eb_f7) +21 more potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1244.ve463715a_f89c)

org.jenkins-ci.plugins:script-security MAVEN version 1244.ve463715af89c is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.openshift.jenkins.plugins:openshift-client 1.1.0.413.v3023d27e8434...

io.jenkins.plugins:cdevents (>=1-37.v6412b_91c3799, <=1-40.vb_3d2c94f2379), io.jenkins.plugins:pipeline-agent-build-history (>=20.v2cb_6cc0a_7d81, <=34.v570d1a_452f30) +4 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1273.v66c1964f0dfd)

org.jenkins-ci.plugins:script-security MAVEN version 1273.v66c1964f0dfd is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:cdevents =1-37.v6412b91c3799, =20.v2cb6cc0a7d81,...

io.jenkins.plugins:coverage-badges-extension (>=-rc6.886d29ff0f4d, <=47.v41e62ecf0928), jp.ikedam.jenkins.plugins:scoring-load-balancer (>=68.va_4591100d6a_b, <=97.v8e470ff53e15) +9 more potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1294.v99333c047434)

org.jenkins-ci.plugins:script-security MAVEN version 1294.v99333c047434 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:coverage-badges-extension =-rc6.886d29ff0f4d,...

org.jenkins-ci.plugins:cas-plugin (1.7.0), org.jenkins-ci.plugins:parallel-test-executor (500.va_5e1c1f1a_211) potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1358.vb_26663c13537)

org.jenkins-ci.plugins:script-security MAVEN version 1358.vb26663c13537 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:cas-plugin 1.7.0 -...