org.6wind.jenkins:lockable-resources (>=1309.ve21874387edf, <=1310.v99ca_947ed698), org.jenkins-ci.plugins:badge (>=2.0, <=2.1) +5 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1361.v913100720139)

org.jenkins-ci.plugins:script-security MAVEN version 1361.v913100720139 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.6wind.jenkins:lockable-resources =1309.ve21874387edf, =2.0, =5.5.0...

io.jenkins.plugins:zohosprints (>=1.0, <=1.1.4), org.jenkins-ci.plugins:build-name-setter (2.0.4) +6 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.54)

org.jenkins-ci.plugins:script-security MAVEN version 1.54 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:zohosprints =1.0, =2.4, =2.62.1, =2.2, =1.78, =2.0.0, =1.14,...

org.jenkins-ci.plugins:groovy (2.1) potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.50)

org.jenkins-ci.plugins:script-security MAVEN version 1.50 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:groovy 2.1 Source cves: CVE-2026-57281 Source advisory:...

com.mig82:folder-properties (57.vde5161ec7a_b_a), com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer (2.5.3) +24 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1336.vf33a_a_9863911)

org.jenkins-ci.plugins:script-security MAVEN version 1336.vf33aa9863911 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.mig82:folder-properties 57.vde5161ec7aba -...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.mig82:folder-properties (>=1.0, <=1.2.1) +14 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.18)

org.jenkins-ci.plugins:script-security MAVEN version 1.18 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.btc.ep:btc-embeddedplatform =1.9.2-beta, =1.0, =0.0.8, =1.0-alpha-1, =1.0-alpha-...

org.jenkins-ci.plugins:ontrack (>=2.32.0, <=2.32.5) potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.28)

org.jenkins-ci.plugins:script-security MAVEN version 1.28 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:ontrack =2.32.0, =2.32.5 Source cves: CVE-2026-57281 Source...

io.jenkins.blueocean:blueocean-pipeline-scm-api (>=1.27.12, <=1.27.16), io.jenkins.plugins:coverage (>=1.11.0, <=1.16.1) +6 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1305.v487433146192)

org.jenkins-ci.plugins:script-security MAVEN version 1305.v487433146192 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.blueocean:blueocean-pipeline-scm-api =1.27.12, =1.11.0,...

org.jenkins-ci.plugins:cas-plugin (1.7.0), org.jenkins-ci.plugins:parallel-test-executor (500.va_5e1c1f1a_211) potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1358.vb_26663c13537)

org.jenkins-ci.plugins:script-security MAVEN version 1358.vb26663c13537 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:cas-plugin 1.7.0 -...

org.jenkins-ci.plugins:extended-choice-parameter (>=0.68, <=0.76) potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.19)

org.jenkins-ci.plugins:script-security MAVEN version 1.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:extended-choice-parameter =0.68, =0.76 Source cves:...

io.jenkins.blueocean:blueocean (1.2.0-beta-1), io.jenkins.blueocean:blueocean-events (1.2.0-beta-1) +9 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.29)

org.jenkins-ci.plugins:script-security MAVEN version 1.29 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.blueocean:blueocean 1.2.0-beta-1 - io.jenkins.blueocean:blueocean-events...

GHSA-WP5X-HRRW-6R4G Jenkins Git client Plugin has an OS command injection vulnerability on agents

Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded into the SSH wrapper script generated by the "Manually provided keys" Git Host Key Verification strategy on Unix agents. This allows attackers able to control the name of a build...

GHSA-C3JM-9VJ7-5V66 Jenkins Script Security Plugin sandbox bypass vulnerability

Jenkins Script Security Plugin provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type cast applied to each element of the...

de.taimos:pipeline-aws (>=1.21, <=1.24), org.jenkins-ci.plugins:pipeline-utility-steps (>=2.0, <=2.0.2) potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1.40)

org.jenkins-ci.plugins:script-security MAVEN version 1.40 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - de.taimos:pipeline-aws =1.21, =2.0, =2.0.2 Source cves: CVE-2026-57280 Source...

de.taimos:pipeline-aws (>=1.21, <=1.24), org.jenkins-ci.plugins:pipeline-utility-steps (>=2.0, <=2.0.2) potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.40)

org.jenkins-ci.plugins:script-security MAVEN version 1.40 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - de.taimos:pipeline-aws =1.21, =2.0, =2.0.2 Source cves: CVE-2026-57281 Source...

io.jenkins.plugins:synopsys-sigma (>=2021.12.0, <=2022.1.0) potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.71)

org.jenkins-ci.plugins:script-security MAVEN version 1.71 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:synopsys-sigma =2021.12.0, =2022.1.0 Source cves: CVE-2026-57281...

com.testinium.jenkins:testinium (1.0), me.vickychijwani.jenkins:labelled-steps (1.0) +29 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.25)

org.jenkins-ci.plugins:script-security MAVEN version 1.25 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.testinium.jenkins:testinium 1.0 - me.vickychijwani.jenkins:labelled-steps 1.0 -...

io.jenkins.plugins:createos-sandbox (24.vfe318c36a_db_8), io.jenkins.plugins:gitea-checks (606.679.vb_d632867a_6b_b) +10 more potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1402.v94c9ce464861)

org.jenkins-ci.plugins:script-security MAVEN version 1402.v94c9ce464861 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:createos-sandbox 24.vfe318c36adb8 -...

Jenkins Script Security Plugin sandbox bypass vulnerability

Jenkins Script Security Plugin provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type cast applied to each element of the...

GHSA-2W2H-GWWJ-FH3Q Jenkins Pipeline: Groovy Plugin vulnerable to unrestricted instantiation of types

Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, instantiating any type with a constructor annotated with @DataBoundConstructor in response to a request. This allows attackers to have...

GHSA-CFJ9-2VGR-HPXP Jenkins Script Security Plugin has a script security bypass vulnerability

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations such as @CompileStatic and @TypeChecked that carry an extensions member, which causes Groovy to load and execute a script from the classpath at compile time, before the sandbox is...