CVE-2026-92128: Jenkins Script Security Unlocalized Classpath Toctou
Classpath entry is checked with ScriptApproval.using(entry) and its URL is loaded directly without localizing remote content to a local temporary file first. An attacker controlling the remote URL can return benign code during verification and malicious code when loaded by the ClassLoader (TOCTOU). Download remote classpath entries locally and verify using S
Javagreprules fetch cve-2026-92128-jenkins-script-security-unlocalized-classpath-toctou --engine opengrepDescription
Classpath entry is checked with ScriptApproval.using(entry) and its URL is loaded directly without localizing remote content to a local temporary file first. An attacker controlling the remote URL can return benign code during verification and malicious code when loaded by the ClassLoader (TOCTOU). Download remote classpath entries locally and verify using S
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.