CVE-2026-57280
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk29th percentile — higher than 29% of all known CVEs
Summary
Jenkins Script Security Plugin version 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection.
Risk Assessment
An attacker can bypass the sandbox protection and execute unauthorized code on the Jenkins server, potentially leading to system compromise, data theft, or disruption of CI/CD infrastructure.
Recommendation
It is recommended to immediately update the Script Security plugin to a version later than 1402.v94c9ce464861, which includes a fix blocking implicit type casts in for-each loops.
Original NVD description (English source)
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection.