Executive brief
GoCD is a continuous delivery server that integrates with issue tracking systems like JIRA by automatically generating links in commit comments. When using certain tracking tool regex patterns, attackers with repository commit access can inject HTML or URI characters into commit messages that trigger stored cross-site scripting when displayed on the Compare Pipeline page. Successful exploitation allows attackers to steal privileged user sessions or perform actions on behalf of victims viewing the page.
Technical details
The vulnerability is a stored cross-site scripting issue in GoCD's tracking tool link rendering. When a project uses a lenient regex pattern with an ID capturing group (e.g., JIRA-(.+)), commit comments matching this pattern are converted to unescaped links in the Compare Pipeline UI. An attacker with commit access can inject special characters into matching commit message fields, which are not properly HTML-escaped before rendering, allowing arbitrary script execution in the victim's browser context.
Affected products
- ThoughtWorks GoCD 18.3.0 to 26.0.x
Timeline
- 2026-09-21: disclosed
- 2026-05-10: patched: Fix merged in commit 1adba7d to version 26.1.0