The Jenkins Script Security Plugin up to version 1402.v94c9ce464861 does not properly reject Groovy AST transformation annotations that carry an extensions member. This oversight enables attackers with the ability to run sandboxed Groovy scripts to escape the sandbox restrictions and execute arbitrary code outside the sandbox environment, provided that an appropriate script exists on the classpath of the component evaluating the script. The vulnerability is published but lacks a CVSS score and no vendor advisory or patch information is available at this time.

Attackers able to run sandboxed Groovy scripts in Jenkins environments using the affected plugin versions may bypass sandbox restrictions and execute arbitrary code outside the sandbox. This could lead to unauthorized code execution within the Jenkins environment, potentially compromising the system integrity depending on the privileges of the Jenkins process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict the ability to run sandboxed Groovy scripts to trusted users only and monitor for suspicious activity related to script execution.