Is CVE-2026-52741 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52741 being exploited in the wild.

How severe is CVE-2026-52741?

Informational severity, published 21 September 2026.

Which products and versions are affected?

ThoughtWorks GoCD 18.3.0 to 26.0.x.

Is there a fix for CVE-2026-52741?

A patch was published on 2026-05-10: Fix merged in commit 1adba7d to version 26.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-52741 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-52741?

Check whether you run ThoughtWorks GoCD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52741: GoCD stored cross-site scripting in tracking tool links

CVE-2026-52741 · Severity: info · Published 2026-09-21

GoCD is a continuous delivery server that integrates with issue tracking systems like JIRA by automatically generating links in commit comments. When using certain tracking tool regex patterns, attackers with repository commit access can inject HTML or URI characters into commit messages that trigger stored cross-site scripting when displayed on the Compare Pipeline page. Successful exploitation allows attackers to steal privileged user sessions or perform actions on behalf of victims viewing the page.

Technologies: ThoughtWorks GoCD. Vendors: ThoughtWorks.

Quick answers

Is CVE-2026-52741 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52741 being exploited in the wild.
How severe is CVE-2026-52741?: Informational severity, published 21 September 2026.
Which products and versions are affected?: ThoughtWorks GoCD 18.3.0 to 26.0.x.
Is there a fix for CVE-2026-52741?: A patch was published on 2026-05-10: Fix merged in commit 1adba7d to version 26.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52741 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-52741?: Check whether you run ThoughtWorks GoCD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored cross-site scripting issue in GoCD's tracking tool link rendering. When a project uses a lenient regex pattern with an ID capturing group (e.g., JIRA-(.+)), commit comments matching this pattern are converted to unescaped links in the Compare Pipeline UI. An attacker with commit access can inject special characters into matching commit message fields, which are not properly HTML-escaped before rendering, allowing arbitrary script execution in the victim's browser context.

Affected products

ThoughtWorks GoCD 18.3.0 to 26.0.x

Timeline

2026-09-21: disclosed
2026-05-10: patched: Fix merged in commit 1adba7d to version 26.1.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.