CVE-2026-68919: GoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pages
GoCD is a continuous deliver server. From 13.3.0 until 26.1.0, GoCD does not correctly encode and escape malicious material modification comments that mimic the special trackback format used by package materials when rendering the Stage Detail, Job/Build Detail, Value Stream Map, and Pipeline History views. A user with write access to a material tracked by GoCD can store arbitrary HTML or JavaScript in a forged package material comment, which executes in the browser session of a user who later views an affected page. Exploitation requires a victim to view a page that renders the malicious modification, and GoCD does not render every material comment in every view. Successful exploitation can expose a privileged user session or allow changes using the victim's credentials and privileges. This issue is fixed in version 26.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GoCDto a version that resolves this vulnerability.Fixed in 26.1.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs write access to a material tracked by GoCD. They must be able to submit a forged package-material comment containing malicious HTML or JavaScript.
Which users are at risk from a malicious comment?
A user is exposed when they view a Stage Detail, Job/Build Detail, Value Stream Map, or Pipeline History page that renders the malicious modification. The impact follows the viewing user's privileges and can expose their session or enable actions using their credentials.
Are all material comments rendered in vulnerable pages?
No. GoCD does not render every material comment in every view, so exploitation depends on the affected modification being displayed on a supported page.
What versions should be remediated?
GoCD versions from 13.3.0 until 26.1.0 are affected. Upgrade to version 26.1.0, which fixes the issue.