CVE-2017-1000107: Sandbox bypass in Jenkins Script Security Plugin sandbox bypass

The vulnerability stems from missing sandbox checks for specific Groovy language constructs. The advisory explicitly identifies four bypass vectors: method references, positional constructor args, type coercion, and super constructor calls. Each corresponds to a security ticket (SECURITY-566/567/580/582) and specific AST processing functions in the Script Security Plugin. The functions listed are core sandbox enforcement points that lacked necessary validation in vulnerable versions, as evidenced by the patch notes requiring added restrictions for these expression types. Runtime exploitation would trigger these functions during malicious Groovy script evaluation.