A critical vulnerability in the Jenkins Script Security Plugin allows authenticated attackers to achieve arbitrary code execution on the Jenkins controller by bypassing sandbox security controls.

This vulnerability involves an improper validation of Groovy annotations, specifically @GroovyASTTransformationClass, which allows an authenticated user with script execution permissions to execute arbitrary code within the Jenkins controller JVM.

The ability to execute arbitrary code on the Jenkins controller represents a total compromise of the CI/CD pipeline and the underlying server environment. With a CVSS score of 8.8, this flaw poses a severe risk of data exfiltration, lateral movement within the network, and the potential for full system takeover, which could lead to significant operational disruption and loss of intellectual property.

Immediate Action: Review the official Jenkins security advisory for the latest plugin version and apply the update as soon as it is released to resolve the sandbox bypass.

Proactive Monitoring: Monitor Jenkins logs for unusual pipeline activities, unauthorized attempts to define scripts, or unexpected child processes spawned by the Jenkins JVM.

Compensating Controls: Restrict permissions for users authorized to define and run sandboxed scripts to only trusted personnel until the patch can be deployed.

Public Exploit Available: No — there is no confirmed public exploit available.

Given the high CVSS score and the potential for total system compromise, this vulnerability should be treated with high priority. Organizations using the Jenkins Script Security Plugin must track the vendor advisory closely and prepare to deploy the remediation immediately upon availability to prevent unauthorized code execution.