Authenticated code execution via AST annotation extensions

Sandbox bypass in Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier allows remote authenticated users to execute code. During sandbox compilation, the plugin accepts @CompileStatic or @TypeChecked annotations whose extensions member makes Groovy load and execute a classpath script before sandbox checks apply. Exploitation requires permission to define and run sandboxed Groovy plus a suitable Groovy source file on the evaluator's classpath; the Jenkins security team found no dangerous candidate in core or plugins.