CVE-2026-92126

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d

Description Users with permission to define and run sandboxed scripts, such as Pipelines, can execute code outside the sandbox. This occurs because the plugin fails to reject @Builder annotations when the builderStrategy member specifies an arbitrary class, provided a suitable class exists on the classpath of the component evaluating the script.

Recommendations Update Jenkins Script Security Plugin to a version later than 1415.v9a f9b 3a c253d.