Jenkins Script Security Plugin versions 1415.v9a_f9b_3a_c253d and earlier contain a vulnerability where the method called through a proxy created during coercion of a value to an interface in sandboxed scripts is not properly checked. If the value inherits a method with the same name as an interface method, this flaw allows attackers who can define and run sandboxed scripts, including Pipeline scripts, to bypass sandbox restrictions and execute arbitrary code within the Jenkins controller JVM context.

Attackers with permission to run sandboxed scripts can exploit this vulnerability to bypass sandbox protections and execute arbitrary code on the Jenkins controller. This could lead to full compromise of the Jenkins controller environment, potentially affecting the integrity and confidentiality of the CI/CD pipeline and related infrastructure.

Patch status is not yet confirmed — check the Jenkins Project vendor advisory for current remediation guidance. Until a fix is available, restrict permissions to define and run sandboxed scripts to trusted users only to reduce the risk of exploitation.