Read the docs
TI-2026-37859 Aliases CVE-2026-52741

GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages

Priority LOW 34CWE-80Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
High
Attack requirements
Present
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-80.

Summary

GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenient Tracking Tool regular expression with an ID capturing group, such as JIRA-(.+). An attacker with commit access to a tracked material can place URI or HTML special characters in a matching commit comment, causing stored cross-site scripting when a victim views an affected Compare Pipeline page. Deployments without Tracking Tool integration, without an ID capturing group, or with conservative matchers that cannot match special characters are not affected. Successful exploitation can expose a privileged user session or allow changes using the victim's credentials and privileges. This issue is fixed in version 26.1.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00538 45th percentileScored 2026-11-07
Fix Fixed gocd (gocd): 26.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gocdgocd18.3.0 to before 26.1.026.1.0Patch availableCNA
  • gocd Vendorgocd Affected 18.3.0 to before 26.1.0 Fixed in 26.1.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:thoughtworks:gocd:*:*:*:*:*:*:*:*——gocd
  • cpe:2.3:a:thoughtworks:gocd:*:*:*:*:*:*:*:* Versions — — ·gocd

Remediation

  • Fix · CNA gocd (gocd) Fixed in 26.1.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-52741

References

Other 5

  • TI-2021-09947 An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version… CVSS 3.1MEDIUM 6.5
  • TI-2021-19282 An issue was discovered in ThoughtWorks GoCD before 21.3.0. CVSS 3.1HIGH 7.5
  • TI-2021-19285 An issue was discovered in ThoughtWorks GoCD before 21.3.0. CVSS 3.1CRITICAL 9.8
  • TI-2021-20193 Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be… CVSS 3.1CRITICAL 9.8
  • TI-2022-18687 Compromised agents may be able to execute remote code on GoCD Server CVSS 3.1CRITICAL 9.1
  • TI-2022-11727 Command Injection/Argument Injection in GoCD CVSS 3.1HIGH 8.8
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences