Executive brief
GoCD is a continuous delivery server used to automate software build and deployment pipelines. Versions 13.3.0 through 26.0.x contain a stored cross-site scripting vulnerability in material modification comments that allow users with write access to inject arbitrary HTML and JavaScript. When privileged users view pipeline details, job details, or pipeline history pages, the malicious code executes in their browser session, potentially exposing credentials or allowing unauthorized changes to the system.
Technical details
The vulnerability is a stored XSS flaw in how GoCD renders package material modification comments across multiple UI views (Stage Detail, Job/Build Detail, Value Stream Map, Pipeline History). Attackers with write access to materials tracked by GoCD can craft forged package material comments that mimic the trackback format and bypass encoding/escaping mechanisms. Exploitation requires a victim to view a page that renders the malicious comment, and the attack vector is network-based through a user's authenticated session.
Affected products
- GoCD GoCD 13.3.0 to 26.0.x
Timeline
- 2026-09-21: disclosed
- 2026-07-05: patched: Fix merged and released in version 26.1.0