CVE-2026-52741
Received Received - Intake

Stored XSS in GoCD Pipeline Compare Page via Tracking Tool Links

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenient Tracking Tool regular expression with an ID capturing group, such as JIRA-(.+). An attacker with commit access to a tracked material can place URI or HTML special characters in a matching commit comment, causing stored cross-site scripting when a victim views an affected Compare Pipeline page. Deployments without Tracking Tool integration, without an ID capturing group, or with conservative matchers that cannot match special characters are not affected. Successful exploitation can expose a privileged user session or allow changes using the victim's credentials and privileges. This issue is fixed in version 26.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-52741
EUVD
EUVD-2026-83949

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
thoughtworks gocd 26.1.0
thoughtworks gocd From 18.3.0 (inc) to 26.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GoCD versions 18.3.0 to 26.1.0 are vulnerable to stored cross-site scripting (XSS) due to improper handling of commit comments when a Tracking Tool regex includes an ID capturing group like JIRA-(.+). Attackers with commit access can inject URI or HTML special characters in comments, creating unescaped links that execute scripts when viewed on the Compare Pipeline page. This affects deployments using lenient regex patterns but not those without Tracking Tool integration or with conservative matchers.

Detection Guidance

Check GoCD versions prior to 26.1.0 using system commands like 'dpkg -l | grep gocd' or 'rpm -qa | grep gocd' on Linux. Inspect Tracking Tool regex patterns in GoCD configuration files for lenient patterns like JIRA-(.+) that capture special characters. Monitor browser console logs for XSS errors when viewing Compare Pipeline pages.

Impact Analysis

An attacker could hijack privileged user sessions or perform unauthorized actions using the victim's credentials. Exploitation requires only commit access to monitored materials, not a full GoCD account. Victims viewing affected pipeline pages may have their sessions compromised or settings altered without their knowledge.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by enabling stored cross-site scripting (XSS) attacks. Successful exploitation may expose privileged user sessions or allow unauthorized changes using victim credentials, which could lead to unauthorized data access or modification. This is particularly critical for environments handling sensitive data under these regulations.

Mitigation Strategies

Upgrade GoCD to version 26.1.0 or later immediately. If upgrading is not possible, disable Tracking Tool integration or review and tighten regex patterns to exclude special characters. Apply strict Content-Security-Policy headers to mitigate XSS risks. Block access to /go/admin/restful/* via reverse proxies as a temporary measure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52741. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart