GoCD versions 18.3.0 through 26.0.9 are vulnerable to a stored cross-site scripting attack that could lead to unauthorized account takeover or credential misuse.

This vulnerability involves the improper neutralization of script-related HTML tags, specifically within tracking-tool links generated from commit comments. An attacker with existing commit access can inject malicious URI or HTML characters into commit comments, which execute when a privileged user views the affected Compare Pipeline page.

The vulnerability carries a CVSS score of 7.5, indicating a high severity risk due to the potential for significant impact on system integrity and confidentiality. Successful exploitation allows an attacker to hijack a privileged user session, potentially granting them administrative control over the CI/CD pipeline, which could result in unauthorized code deployment or the exposure of sensitive environment secrets.

Immediate Action: Update the GoCD server to version 26.1.0 or later immediately to apply the necessary input sanitization fixes.

Proactive Monitoring: Review access logs for unusual commit comment activity and monitor for unexpected administrative actions performed by service accounts or developers.

Compensating Controls: If immediate patching is not feasible, restrict the use of lenient Tracking Tool regular expressions to prevent the injection of special characters until the update can be applied.

Public Exploit Available: Unknown

Organizations utilizing GoCD should prioritize this update as part of their standard patch management cycle. Given the potential for privilege escalation through session hijacking, ensuring that all instances are upgraded to version 26.1.0 is essential to secure the software supply chain against unauthorized pipeline modifications.