CVE-2026-68919 in GoCD
Summary
by MITRE • 09/21/2026
GoCD is a continuous deliver server. From 13.3.0 until 26.1.0, GoCD does not correctly encode and escape malicious material modification comments that mimic the special trackback format used by package materials when rendering the Stage Detail, Job/Build Detail, Value Stream Map, and Pipeline History views. A user with write access to a material tracked by GoCD can store arbitrary HTML or JavaScript in a forged package material comment, which executes in the browser session of a user who later views an affected page. Exploitation requires a victim to view a page that renders the malicious modification, and GoCD does not render every material comment in every view. Successful exploitation can expose a privileged user session or allow changes using the victim's credentials and privileges. This issue is fixed in version 26.1.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified within GoCD versions ranging from 13.3.0 to 26.1.0 represents a significant security flaw rooted in improper input validation and output encoding mechanisms. Specifically, the application fails to correctly encode or escape malicious content embedded within modification comments associated with package materials. This technical deficiency allows an attacker who possesses write access to a material tracked by GoCD to inject arbitrary HTML or JavaScript code into these comment fields. The injection is facilitated by crafting forged package material comments that mimic the special trackback format utilized by the system, thereby bypassing initial parsing checks and allowing malicious payloads to be stored within the application's data structures without immediate detection or sanitization.
The operational impact of this flaw manifests as a Stored Cross-Site Scripting vulnerability, which poses severe risks to both user sessions and organizational integrity. When an authenticated user with higher privileges views specific pages such as Stage Detail, Job Build Detail, Value Stream Map, or Pipeline History, the browser renders the stored malicious content. Because GoCD does not render every material comment in every view, exploitation is conditional upon the victim navigating to a page that specifically processes and displays the compromised data. Upon rendering, the embedded script executes within the context of the victim's active session, effectively granting the attacker control over the user's browser environment. This execution can lead to the exposure of sensitive session tokens or cookies, facilitating account takeover attacks where an adversary assumes the identity of a privileged user.
Beyond simple credential theft, this vulnerability enables broader malicious activities leveraging the victim's elevated privileges. An attacker could manipulate interface elements, redirect users to phishing sites, or perform unauthorized actions within the GoCD environment using the compromised credentials. This capability undermines the principle of least privilege and compromises the integrity of continuous delivery pipelines by allowing potential tampering with build configurations or deployment processes under the guise of legitimate user activity. The severity is heightened by the fact that it targets administrative or high-privilege users who are critical to maintaining secure software delivery lifecycles, potentially leading to widespread compromise if such accounts are successfully hijacked.
From a classification perspective, this issue aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The attack vector corresponds to ATT&CK technique T1059, specifically the execution of scripts via browser-based mechanisms, and relates to T1078 regarding valid accounts being used for unauthorized access. To mitigate this risk, organizations must upgrade GoCD to version 26.1.0 or later, where the encoding and escaping logic has been corrected to properly sanitize user-supplied input before rendering it in web views. Additionally, implementing strict Content Security Policy headers can provide an additional layer of defense by restricting the execution of inline scripts even if they are injected into the DOM. Regular security audits focusing on output encoding practices across all UI components displaying user-generated content are also recommended to prevent similar vulnerabilities from emerging in other parts of the application infrastructure.