GHSA-cfj9-2vgr-hpxp CVE-2026-57281

Jenkins Script Security Plugin has a script security bypass vulnerability

High Maven

Severity: 7.5 / 10; High · CVSS 3.1
Exploit chance (EPSS): 0.92%; Chance of exploitation in the next 30 days. Higher than 60.41% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection'); CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
Fix: 1402.1405.vc96e74964250; Upgrade org.jenkins-ci.plugins:script-security to this version or later

Description

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations such as @CompileStatic and @TypeChecked that carry an extensions member, which causes Groovy to load and execute a script from the classpath at compile time, before the sandbox is applied.

This may allow attackers able to define and run sandboxed scripts to execute code outside the sandbox, in the rare case that a suitable Groovy script is present on the classpath of the component that evaluates the script.

The Jenkins security team has been unable to identify any Groovy source files in Jenkins core or plugins that would allow attackers to execute dangerous code. While the severity of this issue is declared as High due to the potential impact, successful exploitation is considered very unlikely.

Script Security Plugin 1402.1405.vc96e74964250 rejects any annotation carrying an extensions member during sandbox compilation, before Groovy can resolve or execute the referenced script.

Affected versions

Maven

Package	Vulnerable	Fixed in
org.jenkins-ci.plugins:script-security	`< 1402.1405.vc96e74964250`	`1402.1405.vc96e74964250`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

org.jenkins-ci.plugins:script-security Maven → `1402.1405.vc96e74964250`

maven

<dependency><groupId>org.jenkins-ci.plugins</groupId><artifactId>script-security</artifactId><version>1402.1405.vc96e74964250</version></dependency>

gradle

implementation("org.jenkins-ci.plugins:script-security:1402.1405.vc96e74964250")

Severity breakdown

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: High
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Weakness

CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

How to prevent it

Architecture and Design: Avoid adding user-controlled data into an expression interpreter when possible.
Implementation: If user-controlled data must be added to an expression interpreter, one or more of the following should be performed: Validate that the user input will not evaluate as an expression Encode the user input in a way that ensures it is not evaluated as an expression
System Configuration, Operation: The framework or tooling might allow the developer to disable or deactivate the processing of EL expressions, such as setting the isELIgnored attribute for a JSP page to "true".

CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

How to prevent it

Implementation: Avoid using CRLF as a special sequence.
Implementation: Appropriately filter or quote CRLF sequences in user-controlled input.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2026-57281

Packages

github.com/jenkinsci/script-security-plugin

Timeline

Jun 24, 2026 Published
Oct 25, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
CVE-2019-1003029 Sandbox bypass in Script Security Plugin	Critical Known exploited	Also affects org.jenkins-ci.plugins:script-security
GHSA-c3jm-9vj7-5v66 Jenkins Script Security Plugin sandbox bypass vulnerability	High	Also affects org.jenkins-ci.plugins:script-security
GHSA-p334-gfhq-c7w6 Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths	Medium	Also affects org.jenkins-ci.plugins:script-security
GHSA-jv82-75fh-23r7 Missing permission check in Jenkins Script Security Plugin	Medium	Also affects org.jenkins-ci.plugins:script-security
GHSA-2g4q-9vm9-9fw4 Jenkins Script Security Plugin sandbox bypass vulnerability	High	Also affects org.jenkins-ci.plugins:script-security
GHSA-v63g-v339-2673 Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies	Critical	Also affects org.jenkins-ci.plugins:script-security
GHSA-76qj-9gwh-pvv3 Sandbox bypass in Jenkins Script Security Plugin	High	Also affects org.jenkins-ci.plugins:script-security
GHSA-fv42-mx39-6fpw Whole-script approval in Jenkins Script Security Plugin vulnerable to SHA-1 collisions	High	Also affects org.jenkins-ci.plugins:script-security

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor