CVE-2026-92127

Jenkins Script Security Plugin versions 1415.v9a_f9b_3a_c253d and earlier automatically approve classpath entries in an item configuration when a user with Overall/Administer permission copies the item or updates its configuration through the REST API or CLI . This allows attackers who can define...

CVE-2026-92128

CVE-2026-92128 affects the Jenkins Script Security Plugin (versions 1415.v9a_f9b_3a_c253d and earlier). The root cause is a TOCTOU race condition : when a sandboxed script is evaluated, the plugin downloads a URL-specified JAR file twice —confirming approval of the first download but loading clas...

EUVD-2022-4918

Malicious code in bioql PyPI...

GHSA-Q87G-7MP5-765Q Improper Neutralization of Input During Web Page Generation in Jenkins Script Security Plugin

Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulting in a stored cross-site scripting vulnerability...

jenkins-script-security-plugin: cross-site scripting vulnerability due to configure sandboxed scripts

Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulting in a stored cross-site scripting vulnerability...

jenkins-script-security-plugin: cross-site scripting vulnerability due to configure sandboxed scripts

Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulting in a stored cross-site scripting vulnerability...