HIGHCVSS 7.5EPSS 0.9%

CVE-2026-57281

CVE-2026-57281 updated by NVD

Published: 2026-06-24
Modified: 2026-10-27
EPSS percentile: 59%
Sources: github-advisory, nvd

Summary

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Maven	org.jenkins-ci.plugins:script-security	—	1402.1405.vc96e74964250

Remediation: Upgrade to 1402.1405.vc96e74964250 or later.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-57281

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.