High
Security advisory
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-57280
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 17:12 UTC · Revision 1
Source evidence
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection.
osv:CVE-2026-57280
Complete source record
{
"id": "340ceac724eda9d633e8d7643c13c2b725163566c427976f63ae12b0ee2c4acb",
"url": "https://osv.dev/vulnerability/CVE-2026-57280",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2026-57280",
"summary": "Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection.",
"evidence": "osv:CVE-2026-57280",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-57280",
"aliases": [
"CVE-2026-57280",
"GHSA-c3jm-9vj7-5v66"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/jenkinsci/script-security-plugin",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "94c9ce46486198c13d70c330587c74952e69b15a"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:jenkins:script_security:*:*:*:*:*:jenkins:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "1402.v94c9ce464861"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"1402.v94c9ce464861",
"1399.ve6a_66547f6e1",
"1385.v7d2d9ec4d909",
"1378.vf25626395f49",
"1373.vb_b_4a_a_c26fa_00",
"1369.v9b_98a_4e95b_2d",
"1368.vb_b_402e3547e7",
"1365.v4778ca_84b_de5",
"1362.v67dc1f0e1b_b_3",
"1367.vdf2fc45f229c",
"1366.vd44b_49a_5c85c",
"1361.v913100720139",
"1358.vb_26663c13537",
"1354.va_70a_fe478c7f",
"1341.va_2819b_414686",
"1336.vf33a_a_9863911",
"1335.vf07d9ce377a_e",
"1326.vdb_c154de8669",
"1321.va_73c0795b_923",
"1313.v7a_6067dc7087",
"1310.vf24a_dfce068b_",
"1305.v487433146192",
"1301.v0079b_cd0cdfa_",
"1294.v99333c047434",
"1281.v22fb_899df1a_e",
"1275.v23895f409fb_d",
"1274.v2b_33362a_f2f5",
"1273.v66c1964f0dfd",
"1271.vdede89739a_81",
"1269.v639888f5e366",
"1265.va_fb_290b_4b_d34",
"1264.vecf66020eb_7d",
"1251.vfe552ed55f8d",
"1244.ve463715a_f89c",
"1229.v4880b_b_e905a_6",
"1228.vd93135a_2fb_25",
"1218.v39ca_7f7ed0a_c",
"1209.v50b_005db_19db",
"1190.v65867a_a_47126",
"1189.vb_a_b_7c8fd5fde",
"1184.v85d16b_d851b_3",
"1183.v774b_0b_0a_a_451",
"1175.v4b_d517d6db_f0",
"1172.v35f6a_0b_8207e",
"1145.vb_cf6cf6ed960",
"1158.v7c1b_73a_69a_08",
"1146.vdf547f19a_473",
"1140.vf967fb_efa_55a_",
"1138.v8e727069a_025",
"1131.v8b_b_5eda_c328e",
"1125.v132f99385e1b_",
"1118.vba21ca2e3286",
"script-security-1.78",
"script-security-1.77",
"script-security-1.76",
"script-security-1.75",
"script-security-1.74",
"script-security-1.73",
"script-security-1.72",
"script-security-1.71",
"script-security-1.70",
"script-security-1.69",
"script-security-1.68",
"script-security-1.67",
"script-security-1.66",
"script-security-1.65",
"script-security-1.64",
"script-security-1.63",
"script-security-1.62",
"script-security-1.61",
"script-security-1.60",
"script-security-1.59",
"script-security-1.58",
"script-security-1.57",
"script-security-1.56",
"script-security-1.55",
"script-security-1.54",
"script-security-1.53",
"script-security-1.52",
"script-security-1.51",
"script-security-1.50",
"script-security-1.49",
"script-security-1.48",
"script-security-1.47",
"script-security-1.46",
"script-security-1.45",
"script-security-1.44",
"script-security-1.43",
"script-security-1.42",
"script-security-1.41",
"script-security-1.40",
"script-security-1.39",
"script-security-1.38",
"script-security-1.37",
"script-security-1.36",
"script-security-1.35",
"script-security-1.34",
"script-security-1.33",
"script-security-1.32",
"script-security-1.31",
"script-security-1.30",
"script-security-1.29",
"script-security-1.28",
"script-security-1.27",
"script-security-1.26",
"script-security-1.25",
"script-security-1.24",
"script-security-1.23",
"script-security-1.22",
"script-security-1.21",
"script-security-1.20",
"script-security-1.19",
"script-security-1.18",
"script-security-1.17",
"script-security-1.16",
"script-security-1.15",
"script-security-1.14",
"script-security-1.13",
"script-security-1.12",
"script-security-1.11",
"script-security-1.10",
"script-security-1.9",
"script-security-1.8",
"script-security-1.7",
"script-security-1.6",
"script-security-1.5",
"script-security-1.4",
"script-security-1.3",
"script-security-1.2",
"script-security-1.1",
"script-security-1.0",
"script-security-1.0-beta-6",
"script-security-1.0-beta-5",
"script-security-1.0-beta-4",
"script-security-1.0-beta-3",
"script-security-1.0-beta-2",
"script-security-1.0-beta-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57280.json"
}
}
],
"modified": "2026-10-27T02:30:57.854830618Z",
"provider": "osv",
"references": [
"https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2026-57280",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 460063,
"published_at": "2026-06-24T14:17:33.91+00:00"
}