CVE-2026-92125CWE-94code-injection

CVE-2026-92125

High · published September 16, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
45.5
In the wild
Unconfirmed
What it is

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to run an arbitrary AST transformation at compile time, bypassing the sandbox protection and executing arbitrary code in the context of the Jenkins controller JVM.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00555 · 45.5th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-09-16T18:17Z
Affected products (1)
ProductVersionsFixed in
jenkins/script_security≤ 1415.v9a_f9b_3a_c253d—
References (1)
https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-3925%20(1) · [email protected]
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 1%
    epss
  • 16 SEP 13:53Z
    Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with…
    cvelistv5