CVE-2026-52741: GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages
GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenient Tracking Tool regular expression with an ID capturing group, such as JIRA-(.+). An attacker with commit access to a tracked material can place URI or HTML special characters in a matching commit comment, causing stored cross-site scripting when a victim views an affected Compare Pipeline page. Deployments without Tracking Tool integration, without an ID capturing group, or with conservative matchers that cannot match special characters are not affected. Successful exploitation can expose a privileged user session or allow changes using the victim's credentials and privileges. This issue is fixed in version 26.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GoCDto a version that resolves this vulnerability.Fixed in 26.1.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Affected deployments run GoCD versions from 18.3.0 up to, but not including, 26.1.0 and use Tracking Tool integration with an ID capturing group in a lenient regular expression. Deployments without Tracking Tool integration, without an ID capturing group, or using conservative matchers that cannot match special characters are not affected.
What access does an attacker need to exploit it?
The attacker needs commit access to a tracked material. They must place URI or HTML special characters in a commit comment that matches the configured Tracking Tool regular expression.
When is the malicious content triggered?
The stored script can execute when a victim views an affected Compare Pipeline page. Impact depends on the victim's privileges and can include exposure of their session or actions performed with their credentials.
What is the available remediation?
Upgrade GoCD to version 26.1.0, which fixes the issue. If upgrading is not immediately possible, avoid lenient Tracking Tool regular expressions with ID capturing groups that can match special characters.