Sandbox bypass in Jenkins Script Security Plugin (CVE-2026-57280)

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type cast applied to each element of the iterated collection in a typed for loop, as the cast is performed during bytecode generation rather than in the transformed script AST. Attackers able to provide sandboxed scripts can invoke constructors of arbitrary types without those invocations being checked by the sandbox, bypassing sandbox protection. This can be used to execute arbitrary code on the Jenkins controller. Affected versions: - Script Security Plugin 1402.v94c9ce464861 and earlier We recommend updating to: Script Security Plugin 1402.1405.vc96e74964250. CVSS 8.8 · our assessment: this_week Reference: https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792 Details: https://vuln.today/cve/CVE-2026-57280