GHSA-5qh3-hxx9-w26p

Source

https://github.com/advisories/GHSA-5qh3-hxx9-w26p

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5qh3-hxx9-w26p/GHSA-5qh3-hxx9-w26p.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5qh3-hxx9-w26p

Aliases

CVE-2026-57301

Published

2026-06-24T15:31:48Z

Modified

2026-09-25T19:30:10Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Jenkins OWASP ZAP Plugin: Builds executed on the Jenkins controller can lead to RCE

Details

Jenkins OWASP ZAP Plugin 1.0.7 and earlier does not support distributed builds, causing the file operations and build process of its "Automatically build ZAP" feature to be performed on the Jenkins controller rather than on the agent the build is assigned to.

This allows attackers with Item/Configure permission to configure the feature to build an attacker-controlled project, executing arbitrary code on the Jenkins controller and bypassing any restriction confining the build to a specific agent.

As of publication of this advisory, there is no fix.

Database specific

{
    "cwe_ids":  [
        "CWE-610"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-25T19:20:00Z",
    "nvd_published_at":  "2026-06-24T14:17:36Z",
    "severity":  "HIGH"
}

References

Affected packages

Maven / org.jenkins-ci.plugins:zapper

Package

Name: org.jenkins-ci.plugins:zapper; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/zapper

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

1.0.7

Affected versions

1.*

1.0.0

1.0.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5qh3-hxx9-w26p/GHSA-5qh3-hxx9-w26p.json"