HIGHCVSS 8.8EPSS 0.5%

CVE-2026-57280

CVE-2026-57280 updated by NVD

Published: 2026-06-24
Modified: 2026-10-27
EPSS percentile: 41%
Sources: github-advisory, nvd

Summary

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Maven	org.jenkins-ci.plugins:script-security	—	1402.1405.vc96e74964250

Remediation: Upgrade to 1402.1405.vc96e74964250 or later.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-57280

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.