CVE-2026-92126

{"id": "CVE-2026-92126", "cveTags": [], "metrics": {}, "affected": [{"source": "jenkinsci-cert@googlegroups.com", "affectedData": [{"vendor": "Jenkins Project", "product": "Jenkins Script Security Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "maven", "lessThanOrEqual": "1415.v9a_f9b_3a_c253d"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-16T14:17:14.580", "references": [{"url": "https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-3925%20(2)", "source": "jenkinsci-cert@googlegroups.com"}], "vulnStatus": "Awaiting Analysis", "descriptions": [{"lang": "en", "value": "Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sandbox if a suitable class is present on the classpath of the component that evaluates the script."}], "lastModified": "2026-09-16T19:26:02.607", "sourceIdentifier": "jenkinsci-cert@googlegroups.com"}