CVE-2026-57280: Jenkins Script Security

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection.

Affected products

• Jenkins Script Security: up to and including 1402.v94c9ce464861

Published 2026-06-24. Last modified 2026-06-26.