CVE-2026-68919: GoCD XSS Vulnerability in Material Comments

CVE-2026-68919 Overview

CVE-2026-68919 is a stored cross-site scripting (XSS) vulnerability in GoCD, a continuous delivery server. The flaw affects versions from 13.3.0 up to (but not including) 26.1.0. GoCD fails to correctly encode and escape modification comments that mimic the special trackback format used by package materials. A user with write access to a tracked material can inject arbitrary HTML or JavaScript into a forged package material comment. The payload executes in the browser of any user who later renders the Stage Detail, Job/Build Detail, Value Stream Map, or Pipeline History views. The issue is tracked under [CWE-80] and fixed in version 26.1.0.

Critical Impact
Successful exploitation can hijack privileged GoCD sessions or perform pipeline changes using the victim's credentials and privileges.

Affected Products

GoCD versions 13.3.0 through 26.0.x
GoCD Server web UI components rendering material modifications
Stage Detail, Job/Build Detail, Value Stream Map, and Pipeline History views

Discovery Timeline

2026-09-21 - CVE-2026-68919 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-68919

Vulnerability Analysis

GoCD supports multiple material types, including package materials whose modification comments are serialized as JSON containing a TYPE field. The server-side rendering pipeline treated any comment matching the trackback JSON pattern as trusted structured data rather than user input. This trust decision was based on string content inspection, not on the actual material type associated with the modification. A user who has write access to a non-package material (for example, a Git repository) can craft a commit message that impersonates the package material JSON format. When GoCD later renders that comment in the UI, the raw content is passed to the browser without HTML escaping. The forged JSON is then interpreted as trusted markup, permitting execution of attacker-supplied script in the victim's session.

Root Cause

The root cause is inconsistent handling of the comment field across material types in MaterialRevisionsJsonBuilder.java and the materials_helper.rb view helper. The Ruby helper used a regex match against "TYPE":"PACKAGE_MATERIAL" inside the comment body to decide the rendering path. This allowed non-package materials to trigger the package-material rendering branch, which returned the comment as raw HTML instead of applying the escaping performed by commentRenderer.render().

Attack Vector

Exploitation requires an authenticated user with write access to a material tracked by GoCD. The attacker commits or pushes a modification whose comment includes forged package-material JSON with an embedded script payload. A victim, typically an administrator or pipeline operator, must then view one of the affected pages that renders the modification. No additional privileges are required from the attacker beyond material write access, but user interaction from the victim is required.

java

// Patch: MaterialRevisionsJsonBuilder.java
// Source: https://github.com/gocd/gocd/commit/a03eeeaa4a85edfc9053e743610547d4fcf7aea6

        jsonMap.put("user", modification.getUserDisplayName());
        jsonMap.put("revision", modification.getRevision());
        jsonMap.put("date", Dates.formatIso8601SystemCompactOffsetNoMillis(modification.getModifiedTime()));
-        jsonMap.put("comment", PackageMaterial.TYPE.equals(revision.getMaterial().getMaterialType())
-            ? modification.getComment() // Send back what should be raw JSON for rendering on UI :-(
-            : commentRenderer.render(modification.getComment())
+        jsonMap.putAll(PackageMaterial.TYPE.equals(revision.getMaterial().getMaterialType())
+            ? Map.of("commentFormat", "json", "comment", modification.getComment())
+            : Map.of("commentFormat", "html", "comment", commentRenderer.render(modification.getComment()))
         );
         jsonMap.put("modifiedFiles", modifiedFilesJson);

The patch replaces content-based inspection with an explicit commentFormat marker derived from the true material type. The helper change enforces the same rule server-side:

ruby

# Patch: materials_helper.rb
# Source: https://github.com/gocd/gocd/commit/a03eeeaa4a85edfc9053e743610547d4fcf7aea6

-  def render_comment_markup_for(comment, pipeline_name)
-    if /\"TYPE\":\"PACKAGE_MATERIAL\"/.match(comment)
+  def package_material?(material_type)
+    material_type == com.thoughtworks.go.config.materials.PackageMaterial::TYPE
+  end
+
+  def render_comment_markup_for(comment, material_type, pipeline_name)
+    if package_material?(material_type)
       render_comment_for_package_material(comment)
     else
       render_tracking_tool_link_for_comment(comment, pipeline_name).html_safe
     end
   end

Detection Methods for CVE-2026-68919

Indicators of Compromise

Material modification comments in non-package materials that contain the substring "TYPE":"PACKAGE_MATERIAL".
Commit messages or SCM comments containing <script> tags, event handlers such as onerror=, or encoded JavaScript URIs.
Unexpected outbound HTTP requests from browser sessions of GoCD administrators shortly after viewing pipeline or stage detail pages.
Newly created GoCD API tokens, pipeline configuration changes, or user role modifications tied to administrator accounts that recently viewed a suspect modification.

Detection Strategies

Scan the GoCD server database and material history for existing modification comments matching the trackback JSON pattern originating from non-package materials.
Inspect Git and SCM audit logs for commits whose author is an internal contributor but whose message mimics package trackback JSON.
Correlate GoCD access logs with administrator session activity to identify views of affected pages immediately preceding privilege changes.

Monitoring Recommendations

Enable and centralize GoCD server access and audit logs, then forward them to a security analytics platform for review.
Monitor the GoCD audit trail for configuration changes performed by administrators shortly after page views containing suspicious material revisions.
Alert on any new modification whose comment contains HTML tags or the literal string PACKAGE_MATERIAL from a non-package material source.

How to Mitigate CVE-2026-68919

Immediate Actions Required

Upgrade all GoCD server installations to version 26.1.0 or later without delay.
Audit existing material modifications for forged package-material comments and remove or quarantine offending revisions.
Review recent administrator activity for unauthorized pipeline, user, or credential changes that may indicate prior exploitation.
Restrict material write access to trusted users until the upgrade is complete.

Patch Information

The vulnerability is fixed in GoCD 26.1.0. Refer to the GitHub Security Advisory GHSA-pp5x-wgv2-g37p, the GitHub Release Tag 26.1.0, and the GoCD Release Overview 26.1.0 for upgrade details. The corrective code is available in the GitHub Commit Log.

Workarounds

Limit write access on tracked materials to a minimal set of trusted contributors until upgrading is possible.
Instruct GoCD administrators to avoid viewing Stage Detail, Job/Build Detail, Value Stream Map, and Pipeline History pages for pipelines fed by untrusted material sources.
Enforce a strict Content Security Policy at a reverse proxy in front of GoCD to reduce the impact of injected scripts.

bash

# Verify GoCD server version after upgrade
curl -s -u <admin>:<token> https://<gocd-host>/go/api/version | jq .

# Example reverse-proxy CSP header (nginx) to reduce XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'";