What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Some Groovy annotations can run code during compilation, before Jenkins applies the runtime checks of its Script Security sandbox. That creates a gap: the sandbox may restrict a script’s method calls, object construction, and field access without intercepting an annotation-driven transformation that has already run. Jenkins has fixed several specific pathways in specific Script Security Plugin releases; annotations are not all unsafe, and the fix depends on the advisory involved.
Why an annotation can run before the sandbox checks a script
Groovy compilation is not just preparation for later execution. An annotation can ask Groovy to transform a script or generate code while the compiler processes it. The transformation may load or instantiate classes, or execute other logic, before the script begins running.
As an Amazon Associate I earn from qualifying purchases.
Jenkins describes the Groovy Sandbox as checking operations such as method calls, object construction, and field access as a script runs. If an annotation triggers behavior during compilation, those runtime checks may not mediate that behavior. This is why compile-time restrictions and runtime sandbox checks solve different parts of the problem. Jenkins explains the sandbox and compiler configuration in its Script Security Plugin documentation.
This does not mean every annotation bypasses the sandbox. The documented vulnerabilities concern particular transformation mechanisms and plugin versions. Use the relevant advisory to determine whether a specific installation is affected.
Which annotation pathways Jenkins has fixed
| Advisory and pathway | Affected version stated by Jenkins | Fix stated by Jenkins | What happened during compilation |
|---|---|---|---|
September 16, 2026: @GroovyASTTransformationClass |
Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier |
1422.v06869826dd9b_ |
A script could connect an annotation type it declared to an arbitrary AST transformation. Groovy could run that transformation before sandbox application. |
September 16, 2026: @Builder with an arbitrary strategy |
Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier |
1422.v06869826dd9b_ |
Groovy could instantiate a strategy class named by the annotation to generate builder code during compilation. |
June 24, 2026: AST transformation annotations with an extensions member, including @CompileStatic and @TypeChecked |
Script Security Plugin 1402.v94c9ce464861 and earlier |
1402.1405.vc96e74964250 |
The member could cause a script to be loaded from the classpath and executed before the sandbox applied. |
January 2019: unsafe AST transformations, including @Grab |
See the affected versions in Jenkins’ advisory | The advisory prohibited known unsafe transformations in sandboxed scripts; a January 28 follow-up addressed validation endpoints with safe compiler configurations. | Transformation behavior could occur during compilation rather than through ordinary sandboxed script execution. |
The September 2026 details and version boundaries are in the Jenkins Security Advisory for September 16, 2026. For the June issue’s classpath prerequisite and severity qualification, see the Jenkins Security Advisory for June 24, 2026. The earlier @Grab case and validation-endpoint follow-up are described in the January 2019 Jenkins Security Advisory.
September 2026: declared transformations and builder strategies
For @GroovyASTTransformationClass, Jenkins says Script Security Plugin 1422.v06869826dd9b_ rejects the annotation during sandbox compilation, before Groovy can resolve or execute the referenced script. For @Builder, the same release rejects builder strategies other than those provided by Groovy during sandbox compilation.
There is a usability detail for built-in builder strategies: Jenkins notes a limitation involving star imports. The built-in strategies can still be used through a fully qualified name or a single-class import. Do not treat this exception as permission to use an arbitrary strategy class.
Free tools Windows power users keep installed
One-click scans. No signup required.
The September advisory also covers other Script Security issues, including a collection-cast sandbox bypass and a classpath approval bypass. Those are separate vulnerabilities, not additional annotation pathways, and should be assessed under their own advisory entries.
Rank #3
June 2026: an extensions member
Jenkins says the affected versions did not reject AST transformation annotations such as @CompileStatic and @TypeChecked when they carried an extensions member. The specified fix, 1402.1405.vc96e74964250, rejects any annotation carrying that member during sandbox compilation.
The advisory rates the issue High but says successful exploitation is considered very unlikely: a suitable Groovy script must be present on the evaluating component’s classpath. Jenkins’ Security Team said it could not identify such a dangerous Groovy source file in Jenkins core or plugins. That qualification applies to this specific issue; it should not be generalized to the other advisories.
Rank #4
- Used Book in Good Condition
Earlier @Grab cases
Jenkins’ January 2019 advisory documents compilation-time bypasses involving AST-transforming annotations such as @Grab. A follow-up noted that the initial fix had not covered a validation endpoint, which was changed to use safe compiler configurations. Jenkins later documented an incomplete-fix issue involving @Grab on imports or inside other annotations; Script Security Plugin 1.70 disallowed known unsafe transformations in those positions. This history shows why a fix for one annotation route should not be taken as proof that every compiler-time route is safe.
How the Jenkins controls differ
| Control | When it acts | What it controls |
|---|---|---|
| Groovy Sandbox | As sandboxed script operations run | Calls, object construction, and field access against approved operations; an unapproved operation halts the script. |
| Script Approval | Before an unapproved script or signature is allowed | Approval of whole scripts or permission for additional method signatures. |
| Safe compiler configuration or advisory-specific annotation rejection | During sandbox compilation | Known unsafe transformation or annotation pathways addressed by the applicable compiler restrictions or fix. |
Script Approval is not a substitute for sandboxing, and sandboxing is not a substitute for safe compiler configuration. Jenkins describes the administrative approval process in its In-process Script Approval documentation. Pipeline scripts generally run in the sandbox by default, including administrator-authored Pipelines, according to Jenkins’ Script Security Plugin documentation.
Best Value
What Jenkins administrators should check
- Identify the affected component and version. Check the Script Security Plugin version installed on the Jenkins controller, then compare it with the affected and fixed versions in the relevant September 2026 or June 2026 advisory. A fix for one pathway does not establish that a different pathway is fixed.
- Install the applicable fixed release. For the September annotation cases, Jenkins identifies
1422.v06869826dd9b_; for the June extensions-member issue, it identifies1402.1405.vc96e74964250. Follow Jenkins’ compatibility and upgrade guidance for the controller rather than assuming a version number alone establishes compatibility. - Keep the execution controls distinct. Use sandboxing for untrusted or restricted scripts, and handle script or signature approvals through the approval process. Do not approve a whole script or signature as a substitute for installing a security fix.
- For plugin authors, treat transformations as security-sensitive. Jenkins advises caution with AST transformations, especially global transformations discovered through
META-INF/services. Its developer security recommendations discuss this risk; a blocklist of known unsafe transformations is not a guarantee that every transformation or plugin arrangement is safe.
Pipeline CPS and @NonCPS are separate concerns
The Pipeline: Groovy plugin applies Groovy CPS transformation during compilation. Its documentation explains that @NonCPS changes CPS transformation behavior for designated methods, but those methods remain subject to sandbox security checks. It is not a workaround for unsafe compile-time annotations or a replacement for the Script Security Plugin fixes. See the Pipeline: Groovy plugin documentation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
