CVE-2026-68919
Received Received - Intake

Stored XSS in GoCD Pipeline Comments

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
GoCD is a continuous deliver server. From 13.3.0 until 26.1.0, GoCD does not correctly encode and escape malicious material modification comments that mimic the special trackback format used by package materials when rendering the Stage Detail, Job/Build Detail, Value Stream Map, and Pipeline History views. A user with write access to a material tracked by GoCD can store arbitrary HTML or JavaScript in a forged package material comment, which executes in the browser session of a user who later views an affected page. Exploitation requires a victim to view a page that renders the malicious modification, and GoCD does not render every material comment in every view. Successful exploitation can expose a privileged user session or allow changes using the victim's credentials and privileges. This issue is fixed in version 26.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-68919
EUVD
EUVD-2026-83948

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
thoughtworks gocd From 13.3.0 (inc) to 26.1.0 (exc)
thoughtworks gocd 26.1.0
thoughtworks gocd From 13.3.0 (inc) to 25.4.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GoCD versions 13.3.0 to 26.1.0 have a stored Cross-Site Scripting (XSS) vulnerability. A user with write access to a material can inject malicious HTML or JavaScript into package material comments. When rendered in views like Stage Detail or Pipeline History, this code executes in the browser of any user viewing the page, potentially exposing sessions or allowing unauthorized actions.

Detection Guidance

Check GoCD versions between 13.3.0 and 26.1.0 for exposure. Inspect package material comments in Stage Detail, Job/Build Detail, Value Stream Map, and Pipeline History views for suspicious HTML or JavaScript content. Review server logs for unusual rendering patterns or unauthorized script execution.

Impact Analysis

If exploited, this vulnerability could allow an attacker to steal session cookies, perform actions on your behalf, or expose sensitive data. Victims must view a page rendering the malicious comment, and the attack requires only write access to a tracked material, not a full GoCD account.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. The stored XSS attack may expose privileged user sessions or allow changes using victims' credentials, risking data breaches or unauthorized modifications.

Mitigation Strategies

Upgrade GoCD to version 26.1.0 or later immediately. Temporarily pause or remove materials from untrusted sources. Apply a strict Content-Security-Policy to limit script execution and data exfiltration risks. Monitor affected pages for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68919. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart