{"id":"CVE-2026-92126","title":"Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, includin…","summary":"Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, includin…","severity":"high","cvss":8.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-470"],"vendor":"jenkins","product":"script_security","affected":["script_security <= 1415.v9a_f9b_3a_c253d"],"published":"2026-09-16","updated":"2026-09-21","sourceUpdated":"2026-09-21T17:18:11.130","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92126","references":[{"url":"https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-3925%20(2)","label":"jenkinsci-cert@googlegroups.com"}],"tags":["nvd","cve.org"],"epss":0.00203,"epssPercentile":0.10502,"ingestedAt":"2026-09-16T14:57:28.020Z","slug":"CVE-2026-92126","body":"## Overview\n\nJenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sandbox if a suitable class is present on the classpath of the component that evaluates the script.\n\n## Affected\n\n- `script_security <= 1415.v9a_f9b_3a_c253d`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":46.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":208616,"id":"CVE-2026-92126","ts":1790013040727,"field":"cvss","old":null,"new":"8.5"},{"seq":208615,"id":"CVE-2026-92126","ts":1790013040727,"field":"severity","old":"none","new":"high"}]}