Jenkins Script Security Plugin versions up to 1415.v9a_f9b_3a_c253d do not properly reject @Builder annotations whose builderStrategy member names an arbitrary class. This flaw allows attackers who have permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sandbox environment if a suitable class is available on the classpath of the component evaluating the script. This vulnerability arises from insufficient validation of the builderStrategy attribute, enabling sandbox escape.

Attackers with permission to run sandboxed scripts can bypass sandbox restrictions and execute arbitrary code outside the sandbox, potentially leading to unauthorized actions within the Jenkins environment. The impact depends on the presence of suitable classes on the classpath and the attacker's script execution permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict permissions to define and run sandboxed scripts to trusted users only. Monitor official Jenkins advisories for updates and apply patches promptly once released.