CVE-2026-57280: Jenkins Script Security Plugin Sandbox Bypass Vulnerability
Summary
CVE-2026-57280: Jenkins Script Security Plugin sandbox bypass vulnerability. Affects org.jenkins-ci.plugins:script-security versions < 1402.1405.vc96e74964250. Fixed in 1402.1405.vc96e74964250. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Script Security Plugin is designed to enhance the security of Jenkins by providing a sandbox feature that allows user-provided scripts to run safely. This plugin intercepts and checks potentially unsafe operations to prevent unauthorized access and code execution. However, a vulnerability has been identified that compromises this safety mechanism, allowing attackers to bypass the sandbox protections.
Vulnerability Detail
The vulnerability arises from the Script Security Plugin versions 1402.v94c9ce464861 and earlier, which fail to intercept implicit type casts applied to elements in typed for loops during bytecode generation. This oversight allows attackers to invoke constructors of arbitrary types without the sandbox's checks, potentially leading to arbitrary code execution on the Jenkins controller. The technical flaw lies in the transformation of the script's Abstract Syntax Tree (AST), which does not account for these implicit casts, thus undermining the intended security measures.
How To Fix
Latest published version: 1436.v1082791135e4 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1402.1405.vc96e74964250
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using typed for loops in their scripts until they can update the plugin. This can help mitigate the risk of exploitation while waiting for the patch to be applied.
Conclusion
The Jenkins Script Security Plugin has a critical vulnerability that allows for sandbox bypass, potentially leading to arbitrary code execution. It is essential for users to update to the patched version to secure their Jenkins instances. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for org.jenkins-ci.plugins:script-security →
FAQ
The vulnerability allows attackers to execute arbitrary code on the Jenkins controller, which can lead to unauthorized access and control over the Jenkins environment.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your pom.xml, you can determine if your application is affected by this vulnerability.
The CVSS score for this vulnerability is 8.8, indicating a high severity level.
Yes, you can avoid using typed for loops in your scripts as a temporary workaround until the plugin is updated.
You can find more information on the official Jenkins website or the GitHub repository for the Script Security Plugin.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:script-security.
