Skip to content
Heist/ feed
Back to feed
High

Security advisory

Type: advisorySources: OSVCVE: CVE-2026-57281

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-57281
Confirmed fixed CVEs
Not specified
Updated in this feed
1 Nov 2026, 17:12 UTC · Revision 1

Source evidence

CVE-2026-57281

core-osv · Original source

Published 24 Jun 2026, 14:17 UTC

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.

osv:CVE-2026-57281
Complete source record
{
  "id": "b31ae633c9868ef4ec912f1e5e5be71b9ed22b0f9b0fa5c52e793f3f6c37f80d",
  "url": "https://osv.dev/vulnerability/CVE-2026-57281",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2026-57281",
    "summary": "Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.",
    "evidence": "osv:CVE-2026-57281",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-57281",
      "aliases": [
        "CVE-2026-57281",
        "GHSA-cfj9-2vgr-hpxp"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/jenkinsci/script-security-plugin",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "94c9ce46486198c13d70c330587c74952e69b15a"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:jenkins:script_security:*:*:*:*:*:jenkins:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "1402.v94c9ce464861"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "1402.v94c9ce464861",
            "1399.ve6a_66547f6e1",
            "1385.v7d2d9ec4d909",
            "1378.vf25626395f49",
            "1373.vb_b_4a_a_c26fa_00",
            "1369.v9b_98a_4e95b_2d",
            "1368.vb_b_402e3547e7",
            "1365.v4778ca_84b_de5",
            "1362.v67dc1f0e1b_b_3",
            "1367.vdf2fc45f229c",
            "1366.vd44b_49a_5c85c",
            "1361.v913100720139",
            "1358.vb_26663c13537",
            "1354.va_70a_fe478c7f",
            "1341.va_2819b_414686",
            "1336.vf33a_a_9863911",
            "1335.vf07d9ce377a_e",
            "1326.vdb_c154de8669",
            "1321.va_73c0795b_923",
            "1313.v7a_6067dc7087",
            "1310.vf24a_dfce068b_",
            "1305.v487433146192",
            "1301.v0079b_cd0cdfa_",
            "1294.v99333c047434",
            "1281.v22fb_899df1a_e",
            "1275.v23895f409fb_d",
            "1274.v2b_33362a_f2f5",
            "1273.v66c1964f0dfd",
            "1271.vdede89739a_81",
            "1269.v639888f5e366",
            "1265.va_fb_290b_4b_d34",
            "1264.vecf66020eb_7d",
            "1251.vfe552ed55f8d",
            "1244.ve463715a_f89c",
            "1229.v4880b_b_e905a_6",
            "1228.vd93135a_2fb_25",
            "1218.v39ca_7f7ed0a_c",
            "1209.v50b_005db_19db",
            "1190.v65867a_a_47126",
            "1189.vb_a_b_7c8fd5fde",
            "1184.v85d16b_d851b_3",
            "1183.v774b_0b_0a_a_451",
            "1175.v4b_d517d6db_f0",
            "1172.v35f6a_0b_8207e",
            "1145.vb_cf6cf6ed960",
            "1158.v7c1b_73a_69a_08",
            "1146.vdf547f19a_473",
            "1140.vf967fb_efa_55a_",
            "1138.v8e727069a_025",
            "1131.v8b_b_5eda_c328e",
            "1125.v132f99385e1b_",
            "1118.vba21ca2e3286",
            "script-security-1.78",
            "script-security-1.77",
            "script-security-1.76",
            "script-security-1.75",
            "script-security-1.74",
            "script-security-1.73",
            "script-security-1.72",
            "script-security-1.71",
            "script-security-1.70",
            "script-security-1.69",
            "script-security-1.68",
            "script-security-1.67",
            "script-security-1.66",
            "script-security-1.65",
            "script-security-1.64",
            "script-security-1.63",
            "script-security-1.62",
            "script-security-1.61",
            "script-security-1.60",
            "script-security-1.59",
            "script-security-1.58",
            "script-security-1.57",
            "script-security-1.56",
            "script-security-1.55",
            "script-security-1.54",
            "script-security-1.53",
            "script-security-1.52",
            "script-security-1.51",
            "script-security-1.50",
            "script-security-1.49",
            "script-security-1.48",
            "script-security-1.47",
            "script-security-1.46",
            "script-security-1.45",
            "script-security-1.44",
            "script-security-1.43",
            "script-security-1.42",
            "script-security-1.41",
            "script-security-1.40",
            "script-security-1.39",
            "script-security-1.38",
            "script-security-1.37",
            "script-security-1.36",
            "script-security-1.35",
            "script-security-1.34",
            "script-security-1.33",
            "script-security-1.32",
            "script-security-1.31",
            "script-security-1.30",
            "script-security-1.29",
            "script-security-1.28",
            "script-security-1.27",
            "script-security-1.26",
            "script-security-1.25",
            "script-security-1.24",
            "script-security-1.23",
            "script-security-1.22",
            "script-security-1.21",
            "script-security-1.20",
            "script-security-1.19",
            "script-security-1.18",
            "script-security-1.17",
            "script-security-1.16",
            "script-security-1.15",
            "script-security-1.14",
            "script-security-1.13",
            "script-security-1.12",
            "script-security-1.11",
            "script-security-1.10",
            "script-security-1.9",
            "script-security-1.8",
            "script-security-1.7",
            "script-security-1.6",
            "script-security-1.5",
            "script-security-1.4",
            "script-security-1.3",
            "script-security-1.2",
            "script-security-1.1",
            "script-security-1.0",
            "script-security-1.0-beta-6",
            "script-security-1.0-beta-5",
            "script-security-1.0-beta-4",
            "script-security-1.0-beta-3",
            "script-security-1.0-beta-2",
            "script-security-1.0-beta-1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57281.json"
          }
        }
      ],
      "modified": "2026-10-27T02:30:38.985475317Z",
      "provider": "osv",
      "references": [
        "https://access.redhat.com/security/cve/CVE-2026-57281",
        "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57281.json",
        "https://access.redhat.com/errata/RHSA-2026:60239",
        "https://access.redhat.com/errata/RHSA-2026:60246",
        "https://access.redhat.com/errata/RHSA-2026:60247",
        "https://access.redhat.com/errata/RHSA-2026:60248",
        "https://access.redhat.com/errata/RHSA-2026:60249",
        "https://access.redhat.com/errata/RHSA-2026:60250",
        "https://access.redhat.com/errata/RHSA-2026:60251",
        "https://access.redhat.com/errata/RHSA-2026:60252",
        "https://access.redhat.com/errata/RHSA-2026:60254",
        "https://access.redhat.com/errata/RHSA-2026:60256",
        "https://access.redhat.com/errata/RHSA-2026:60259",
        "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2026-57281",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 460037,
  "published_at": "2026-06-24T14:17:34.023+00:00"
}