Noctyra

Noctyra Noctyra は、コード変換と難読化解除のために設計された AST ベースのフレームワークです。複雑な式やロジックを解決して Python ソースコードを分析・簡略化する、モジュール化されたパイプラインを提供します。 概要 本プロジェクトは、Python の抽象構文木（AST）を処理するための柔軟な環境を提供することを目的としています。一連のプラグイン可能なトランスフォーマーを適用することで、Noctyra は以下のことが可能です。 入れ子になったロジックや条件の簡略化 静的な値や一般的なエンコーディングパターンの解決 動的実行ブロックの可読性の高いコードへの展開...

CVE-2026-92125

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to run an arbitrary AST transformation at compile time, bypassing the sandbox...

CVE-2026-92125

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to run an arbitrary AST transformation at compile time, bypassing the sandbox...

CVE-2026-92125

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to run an arbitrary AST transformation at compile time, bypassing the sandbox...

CVE-2026-92125: Improper Control of Generation of Code

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to run an arbitrary AST transformation at compile time, bypassing the sandbox...

GHSA-CFJ9-2VGR-HPXP Jenkins Script Security Plugin has a script security bypass vulnerability

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations such as @CompileStatic and @TypeChecked that carry an extensions member, which causes Groovy to load and execute a script from the classpath at compile time, before the sandbox is...

CVE-2026-57281

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the...

EUVD-2026-38761

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the...

CVE-2026-57281

The Jenkins Script Security Plugin (version 1402.v94c9ce464861 and earlier) is vulnerable to a sandbox escape. The root cause is the plugin's failure to reject Groovy AST transformation annotations containing an extensions member . This flaw allows an attacker to execute sandboxed Groovy scripts ...

CVE-2026-57281

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the...

CVE-2019-1003000

A flaw was found in Jenkins Pipeline. The Script Security sandbox protection could be circumvented during the script compilation phase by applying AST, transforming annotations such as @Grab to source code elements. Both the pipeline validation REST APIs and actual script/pipeline execution are...