CVE-2026-52741: GoCD Continuous Delivery Server XSS Vulnerability

CVE-2026-52741 Overview

CVE-2026-52741 is a stored cross-site scripting (XSS) vulnerability in GoCD, a continuous delivery server. The flaw affects versions from 18.3.0 up to (but not including) 26.1.0. GoCD generates unescaped tracking-tool links from commit comments when a project uses a lenient Tracking Tool regular expression containing an ID capturing group, such as JIRA-(.+). An attacker with commit access to a tracked material can inject URI or HTML special characters into a matching commit comment. When a victim views the affected Compare Pipeline page, the payload executes in the victim's browser session.

Critical Impact
Successful exploitation can expose a privileged user session or allow attackers to perform actions using the victim's credentials and privileges within GoCD.

Affected Products

GoCD versions 18.3.0 through 26.0.x
GoCD deployments configured with Tracking Tool integration using a regex with an ID capturing group
GoCD projects using lenient matchers such as JIRA-(.+) that permit special characters

Discovery Timeline

2026-09-21 - CVE-2026-52741 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-52741

Vulnerability Analysis

The vulnerability is a stored XSS classified under [CWE-80] (Improper Neutralization of Script-Related HTML Tags in a Web Page). GoCD's tracking-tool feature scans commit messages for patterns matching a user-configured regular expression, then transforms matches into hyperlinks pointing at external issue trackers. The rendering logic in render_comment.ts escaped the surrounding text but failed to escape captured groups used inside generated links. When an attacker inserts HTML metacharacters into the captured portion of a commit message, those characters land unescaped in the DOM of the Compare Pipeline page.

The payload persists across sessions because commit history is durable. Any authenticated GoCD user viewing the affected comparison page becomes a target.

Root Cause

The root cause lies in the comment linkification path within server/src/main/webapp/WEB-INF/rails/webpack/helpers/render_comment.ts. The prior implementation called toLink(matchResult[0]) on the entire matched substring without HTML-escaping the captured ID group before insertion into the link markup. Only the plain text before and after each match was passed through _.escape(). As a result, tracking regexes with permissive capturing groups such as JIRA-(.+) allowed arbitrary characters, including <, >, ", and ', to be emitted verbatim into rendered HTML.

Attack Vector

Exploitation requires an attacker with commit access to any source control material tracked by a vulnerable GoCD project. The attacker commits a message containing the tracking-tool prefix followed by an XSS payload embedded in the capturing group. When a GoCD user with equal or higher privileges opens the Compare Pipeline page for that commit range, the injected markup executes. Deployments without Tracking Tool integration, without an ID capturing group, or with strict matchers that reject special characters are not affected.

typescript

// Patched rendering logic in render_comment.ts
try {
  const regex              = new RegExp(trackingTool.regex);
  const linkIdFromGroup    = regexHasGroups();
  const commentStringParts = [];
  let matchResult          = text.match(regex);
  while (matchResult !== null) {
    commentStringParts.push(_.escape(text.substring(0, matchResult.index)));
    commentStringParts.push(toLink(matchResult, linkIdFromGroup));
    text        = text.substring(matchResult.index! + matchResult[0].length);
    matchResult = text.match(regex);
  }
  commentStringParts.push(_.escape(text));

Source: GoCD commit 1adba7d. The patch introduces a linkIdFromGroup flag and refactors toLink to accept the full match result so captured groups are properly handled during link generation.

Detection Methods for CVE-2026-52741

Indicators of Compromise

Commit messages in tracked repositories containing HTML metacharacters such as <script>, onerror=, or javascript: inside the tracking-tool prefix pattern
Unexpected outbound requests from GoCD web sessions to attacker-controlled domains shortly after users open Compare Pipeline pages
New GoCD administrative actions, pipeline configuration changes, or credential access originating from legitimate user sessions without corresponding user activity

Detection Strategies

Audit the Tracking Tool regex configured for each pipeline group and flag any pattern containing a broad capturing group such as (.+) or (.*)
Scan existing commit history in tracked materials for messages matching the tracking regex where the captured group contains characters outside [A-Za-z0-9_-]
Review GoCD server access logs for /compare/ page requests correlated with suspicious commit ranges

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting in the browser to surface inline script execution attempts on GoCD pages
Monitor GoCD audit logs for privilege changes, pipeline edits, or API token creation performed from unexpected source IPs
Alert on any modification to the Tracking Tool configuration to prevent introduction of overly permissive regexes

How to Mitigate CVE-2026-52741

Immediate Actions Required

Upgrade GoCD to version 26.1.0 or later, which contains the fix in commit 1adba7d
Until upgrade is possible, replace lenient tracking regexes such as JIRA-(.+) with restrictive patterns like JIRA-([A-Z0-9-]+) that reject HTML metacharacters
Rotate GoCD API tokens and session credentials for any user who viewed Compare Pipeline pages containing untrusted commit history

Patch Information

The issue is resolved in GoCD 26.1.0. Refer to the GitHub Security Advisory GHSA-hj3c-q23m-fxcg, the GitHub Pull Request #14356, and the GoCD 26.1.0 release notes for full remediation details.

Workarounds

Disable Tracking Tool integration for pipelines that do not require it
Remove the ID capturing group from tracking regexes where feasible
Enforce commit access controls on tracked materials to restrict who can push commit messages into GoCD-visible history

bash

# Example: replace a lenient tracking regex with a strict one
# Vulnerable configuration
# regex: JIRA-(.+)

# Hardened configuration - only allow alphanumeric issue IDs
regex: JIRA-([A-Z0-9]+)
url_pattern: https://jira.example.com/browse/JIRA-${ID}