{"id":"CVE-2026-92126","revision":"6b39e148d786480db27c4bc67a3b8923","records":[{"revision":"6b39e148d786480db27c4bc67a3b8923","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-92126","aliases":[],"title":"Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including P…","description":"Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sandbox if a suitable class is present on the classpath of the component that evaluates the script.","state":0,"publishedAt":"2026-09-16T13:53:05.664+00:00","modifiedAt":"2026-09-26T23:12:19.465+00:00","affected":[{"ecosystem":"Vendor product","name":"Jenkins Script Security Plugin","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Jenkins Project\",\n                    \"product\": \"Jenkins Script Security Plugin\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"versionType\": \"maven\",\n                            \"lessThanOrEqual\": \"1415.v9a_f9b_3a_c253d\",\n                            \"status\": \"affected\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-3925%20(2)"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-92126","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-92126","identifiers":["CVE-2026-92126"]},"retained":false,"historicalAffected":[]}],"coverage":[]}