Sandbox bypass via Groovy AST transformation annotation in Jenkins Script Security Plugin (CVE-2026-57281)

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations such as @CompileStatic and @TypeChecked that carry an extensions member, causing Groovy to load and execute a classpath script at compile time before the sandbox is applied. Attackers able to define and run sandboxed scripts may execute code outside the sandbox if a suitable Groovy script is present on the classpath of the component that evaluates the script. Affected versions: - Script Security Plugin 1402.v94c9ce464861 and earlier We recommend updating to: Script Security Plugin 1402.1405.vc96e74964250. CVSS 7.5 · our assessment: this_week Reference: https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793 Details: https://vuln.today/cve/CVE-2026-57281