CVE-2026-52741 in GoCD
Summary
by MITRE • 09/21/2026
GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenient Tracking Tool regular expression with an ID capturing group, such as JIRA-(.+). An attacker with commit access to a tracked material can place URI or HTML special characters in a matching commit comment, causing stored cross-site scripting when a victim views an affected Compare Pipeline page. Deployments without Tracking Tool integration, without an ID capturing group, or with conservative matchers that cannot match special characters are not affected. Successful exploitation can expose a privileged user session or allow changes using the victim's credentials and privileges. This issue is fixed in version 26.1.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified within GoCD versions ranging from 18.3.0 to 26.1.0 represents a significant security flaw rooted in improper neutralization of user input, specifically classified under CWE-79: Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting. This issue arises when the continuous delivery server processes commit comments from tracked materials that are configured with lenient regular expressions for tracking tool integration. The core technical flaw occurs because GoCD generates links to external tracking tools, such as JIRA, based on patterns found in these commit messages. When a project utilizes a regex pattern like JIRA-(.+), the system captures any characters following the prefix without sufficient sanitization or encoding before embedding them into HTML output. This lack of input validation allows an attacker with write access to a repository monitored by GoCD to inject malicious payloads directly into the application's rendered pages.
The operational impact of this vulnerability is severe, as it facilitates stored cross-site scripting attacks against users who view affected pipeline comparison pages. By injecting URI or HTML special characters within a commit comment that matches the tracking tool pattern, an attacker can execute arbitrary scripts in the context of the victim’s browser session. This capability enables the theft of sensitive information such as authentication cookies and session tokens, potentially leading to unauthorized access to privileged accounts. Furthermore, attackers may leverage this access to perform actions on behalf of the victim, including modifying configurations or deploying malicious artifacts, thereby compromising the integrity and confidentiality of the continuous delivery pipeline. The attack vector is particularly dangerous because it relies on social engineering through commit messages, which are often trusted by developers reviewing code changes.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Client-side Scripting Injection and potentially Credential Access via Browser Session Hijacking if session tokens are exfiltrated. The exploitation requires the attacker to have commit access to a material that is actively tracked by GoCD using an ID capturing group in its tracking tool configuration. Environments that do not utilize Tracking Tool integration, or those employing conservative matchers that strictly limit input characters, remain unaffected by this specific flaw. However, for organizations relying on flexible regex patterns to automatically link commits with issue trackers, the risk is substantial and requires immediate attention to prevent potential compromise of development workflows.
Mitigation strategies focus primarily on upgrading to version 26.1.0 or later, where the vulnerability has been resolved through improved input handling and output encoding practices. For organizations unable to upgrade immediately, implementing strict regular expression patterns that exclude special characters such as angle brackets, quotes, and slashes can serve as a temporary defensive measure. Additionally, enforcing content security policies within the GoCD web interface may help mitigate some effects of script execution by restricting unauthorized resource loading or inline script evaluation. Regular audits of tracking tool configurations to ensure they do not use overly permissive capturing groups are also recommended to reduce the attack surface associated with this class of input validation errors.