EUVD-2026-83949Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires commit access (PR:L), a specific non-default tracking-tool regex config and victim page view (AC:H, UI:R); stored XSS executes in another user's browser (S:C) enabling session theft and actions (C:H/I:H), no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenient Tracking Tool regular expression with an ID capturing group, such as JIRA-(.+). An attacker with commit access to a tracked material can place URI or HTML special characters in a matching commit comment, causing stored cross-site scripting when a victim views an affected Compare Pipeline page. Deployments without Tracking Tool integration, without an ID capturing group, or with conservative matchers that cannot match special characters are not affected. Successful exploitation can expose a privileged user session or allow changes using the victim's credentials and privileges. This issue is fixed in version 26.1.0.
AnalysisAI
Stored cross-site scripting in GoCD's Compare Pipeline page affects versions 18.3.0 through 25.x and allows an attacker holding commit access to a tracked material to inject URI or HTML special characters into a commit comment that GoCD later renders as an unescaped tracking-tool link. Successful exploitation within a victim's browser session can expose a privileged user's session or permit changes performed with that victim's credentials and privileges, though the CVSS 4.0 vector (AC:H/AT:P/PR:L/UI:P) and the layered prerequisites make this a non-trivial, non-drive-by issue. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires ALL of: (1) GoCD version 18.3.0 through 25.x (fixed in 26.1.0); (2) Tracking Tool integration enabled; (3) a lenient tracking-tool regular expression containing an ID capturing group that can match URI/HTML special characters, e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 score of 7.5 (High) is materially tempered by its own vector: while AV:N places this over the network, AC:H (high complexity), AT:P (present attack requirements), PR:L (requires commit access), and UI:P (victim must view a specific page) all indicate this is not a trivially exploitable, drive-by flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch by upgrading GoCD to 26.1.0, which URI-encodes tracking IDs and escapes the generated href so special characters in commit comments no longer break out of the anchor attribute; see the advisory at https://github.com/gocd/gocd/security/advisories/GHSA-hj3c-q23m-fxcg, the fixing PR https://github.com/gocd/gocd/pull/14356, commit https://github.com/gocd/gocd/commit/1adba7ded0b9ef57e29f1de876a882199e5da1d4, and the release notes at https://github.com/gocd/gocd/releases/tag/26.1.0 and https://www.gocd.org/releases/#26-1-0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all GoCD instances and identify versions 18.3.0 through 25.x, restrict commit access to trusted users, and review commit comments for suspicious URI or HTML special characters; within 7 days, apply the vendor-released patch: GoCD 26.1.0 or later, and if immediate upgrade is not possible, deploy a web application firewall to sanitize or block malicious content in commit comments; within 30 days, verify that all instances are patched, audit privileged sessions and pipeline changes for signs of compromise, and harden repository commit permissions to least privilege.
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to do an un-intended action
GoCD is a continuous delivery server. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low at
GoCD is a continuous delivery server. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low at
In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the `/
Stored cross-site scripting in GoCD (versions 13.3.0 through 26.1.0) allows an authenticated user who holds write access
GoCD is an open source a continuous delivery server. Rated medium severity (CVSS 6.8), this vulnerability is remotely ex
GoCD is a continuous delivery server. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low
GoCD is a continuous delivery server. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low
GoCD is a continuous delivery server. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no a
GoCD is a continuous delivery server. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no a
GoCD is a continuous delivery server. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no a
GoCD is a continuous delivery server. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Thi
Same weakness CWE-80 – Basic XSS
View allShare
External POC / Exploit Code
Leaving vuln.today