CVE-2026-92125

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d

Description The plugin fails to reject the @GroovyASTTransformationClass annotation. This allows users with permissions to define and execute sandboxed scripts, such as Pipelines, to perform an arbitrary Abstract Syntax Tree (AST) transformation during compile time. An AST transformation is a process that modifies the structure of the code before it is compiled. By exploiting this, an attacker can bypass sandbox protections and execute arbitrary code within the Jenkins controller Java Virtual Machine (JVM).

Recommendations Update Jenkins Script Security Plugin to a version later than 1415.v9a f9b 3a c253d.