CVE-2026-48921: Jenkins Pipeline: Groovy Libraries Plugin does not prohibit symbolic links in shared libraries

May 27, 2026 (updated July 1, 2026)

Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries.

This allows attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.

Pipeline: Groovy Libraries Plugin 798.v5cc688825312 prohibits symbolic links in shared libraries.

References

github.com/advisories/GHSA-qjq3-wqj5-g37q
nvd.nist.gov/vuln/detail/CVE-2026-48921
www.jenkins.io/security/advisory/2026-05-27/

Code Behaviors & Features

Detect and mitigate CVE-2026-48921 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →