CVE-2026-52741

Executive Summary

CVE-2026-52741 is a stored cross-site scripting (XSS) vulnerability in GoCD, an open-source continuous delivery server, affecting versions from 18.3.0 through 26.0.x. The flaw arises when GoCD generates hyperlinks from commit comments using a permissive Tracking Tool regular expression that includes an ID capturing group (for example, JIRA-(.+)), allowing an attacker with commit access to inject URI or HTML special characters into a commit message that is later rendered unescaped on the Compare Pipeline page. Successful exploitation can compromise a privileged user's session, enabling unauthorized changes with the victim's credentials and privileges.

Technical Analysis

GoCD supports a "Tracking Tool" integration that parses commit messages to automatically produce clickable links to external issue trackers such as JIRA. The integration is driven by an administrator-configured regular expression containing a capturing group that identifies the issue ID within a commit comment. The vulnerability (classified as CWE-80, Improper Neutralization of Script-Related HTML Tags) occurs because, when the configured regular expression is lenient — for example JIRA-(.+) — the captured content is not properly escaped before being emitted into the link markup. This means any character class that the expression's capturing group can match (including <, >, ", ', &, or javascript: URI fragments) becomes part of the generated link and ultimately part of the rendered HTML.

The attack surface is the commit pipeline rendering path, specifically the Compare Pipeline page, which displays commit information and renders the tracking-tool-derived links. Because this is a stored XSS, the malicious payload is persisted in the source-control material (the commit comment) and is only activated when a victim views the affected page. Exploitation therefore requires the attacker to already possess commit access to a tracked material — a low-privilege position in most CI/CD deployments, since many developers, contractors, or automation accounts can push commits.

Crucially, the vulnerability is configuration-dependent. Deployments are only affected when all of the following hold: (1) Tracking Tool integration is enabled, (2) the configured regular expression contains an ID capturing group, and (3) the matcher is permissive enough to match URI or HTML special characters inside a commit comment. Deployments without Tracking Tool integration, without a capturing group, or with conservative matchers that cannot match special characters are explicitly not affected. This narrows the vulnerable population to GoCD installations that use lenient tracker regexes such as JIRA-(.+).

The issue exists from GoCD 18.3.0 up to (but not including) 26.1.0. Note that no CVSS score has been published by NVD and no EPSS score is available; the vector above is an analytic estimate based on the described attack requirements (network reachable, requires authenticated commit access, requires user interaction to view the page, scope change due to XSS impact on the browser session).

Exploitation Scenarios

The attack chain is inferred from the vulnerability class (stored XSS via unescaped tracking-tool link generation); no public proof-of-concept is available.

1. Reconnaissance / target identification. The attacker identifies a GoCD instance using Tracking Tool integration. This can be inferred from how commit messages are rendered as hyperlinks on pipeline comparison pages, or from knowledge of the target organization's tooling. The attacker must also know or guess that the configured regex is lenient (e.g., JIRA-(.+)) and contains a capturing group.

2. Triggering the flaw class. The attacker, who possesses commit access to a tracked material, pushes a commit whose message contains text that matches the tracking-tool pattern and embeds URI or HTML special characters inside the portion captured by the ID group. Because GoCD does not escape this captured content, the special characters flow into the generated hyperlink markup and are stored in the GoCD data store as part of the commit metadata.

3. Payload / execution. When a privileged user (for example, a release manager or administrator) views the Compare Pipeline page that includes the malicious commit, the stored, unescaped content is rendered in the victim's browser, executing injected script or URI-based payloads (stored XSS). No specific function names or endpoints are published; the mechanism is the client-side rendering of the unescaped tracking-tool link.

4. Post-exploitation impact. Successful script execution runs in the origin of the GoCD server with the victim's session context. Per the advisory, this can expose a privileged user session or allow changes to be performed using the victim's credentials and privileges — for example, altering pipeline configuration, approving deployments, or exfiltrating sensitive build/environment data. Because CI/CD servers frequently hold credentials and deployment rights, the blast radius can extend into downstream environments.

Impact Assessment

The primary impact is compromise of user sessions on a continuous delivery server, which is a high-value target in software supply chains. An attacker who can execute script in a privileged user's browser context may pivot to modifying pipelines, injecting build steps, or altering deployment configuration — activities that can translate into supply-chain compromise if the GoCD instance deploys to production.

Scope is limited to deployments matching the vulnerable configuration (Tracking Tool enabled with a lenient capturing-group regex), and exploitation requires the attacker to already hold commit access to a tracked material. This dual precondition reduces the attack likelihood but does not eliminate it, given that commit access is commonly granted broadly. The scope change (S:C) in the estimated vector reflects that the XSS executes in the victim's browser under the GoCD origin, potentially affecting resources beyond the vulnerable component. No CVSS score was published by NVD, and no EPSS score is available; no CISA KEV listing exists and no public exploit or Nuclei template is known.

Detection Guidance

Sigma Rule

title: Potential GoCD Tracking Tool Stored XSS via Commit Comment
id: 5f9c2a7e-3b14-4d8e-9f21-7a6c0e5b2d31
status: experimental
description: Detects commit comments containing HTML/URI special characters within tracking-tool ID patterns that may indicate stored XSS exploitation in GoCD (CVE-2026-52741)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-52741
author: Valters IT Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1189
logsource:
  category: application
  product: gocd
detection:
  keywords:
    - 'JIRA-'
    - 'onerror='
    - 'onload='
    - 'javascript:'
    - '<script'
    - '<img '
    - '"><'
  selection:
    message|contains:
      - 'JIRA-'
  condition: selection and keywords
fields:
  - user
  - commit
  - message
falsepositives:
  - Legitimate commit messages quoting HTML/URI fragments
level: medium

YARA Rule

rule GoCD_TrackingTool_XSS_Commit_CVE_2026_52741
{
    meta:
        description = "Detects commit metadata or logs containing tracking-tool link injection payloads for CVE-2026-52741"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-52741"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $jira = /JIRA-[^\s]*(<|>|"|'|javascript:|onerror|onload)/
        $html = /(onerror|onload|onmouseover)\s*=/
        $script = "<script"
        $jsuri = "javascript:"

    condition:
        $jira or (1 of ($html, $script, $jsuri) and filesize < 1MB)
}

Suricata IDS Rule

alert http any any -> any any (msg:"Potential GoCD Tracking Tool Stored XSS Payload in Commit Comment (CVE-2026-52741)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/"; content:"commit"; nocase; http.request_body; content:"JIRA-"; http.request_body; pcre:"/JIRA-[^\s]*(<|>|%3C|%3E|javascript%3A|onerror)/i"; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-52741; classtype:web-application-attack; sid:202652741; rev:1;)

Elastic Detection

sequence by user.name
  [process where event.category == "process" and process.command_line : "*JIRA-*" and process.command_line : ("*<script*" or "*onerror*" or "*javascript:*")]

Splunk SPL Query

index=gocd OR index=cicd sourcetype=gocd:server
| search commit_message="*JIRA-*" (commit_message="*<*" OR commit_message="*onerror*" OR commit_message="*javascript:*" OR commit_message="*\"><*")
| table _time, user, commit_message, pipeline, material
| sort - _time

Wazuh OSSEC Rule

<group name="gocd,web,attack,">
  <rule id="100741" level="10">
    <decoded_as>json</decoded_as>
    <field name="commit_message">JIRA-</field>
    <match>onerror|onload|javascript:|&lt;script|&gt;&lt;</match>
    <description>Possible GoCD stored XSS attempt via tracking-tool commit comment (CVE-2026-52741)</description>
    <mitre>
      <id>T1189</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Where Tracking Tool integration is not required, disable it. For integrations that are required, replace lenient regular expressions such as JIRA-(.+) with conservative matchers that constrain the capturing group to a safe character class (e.g., an explicit issue-ID pattern limited to alphanumerics and hyphens), so that URI or HTML special characters can no longer be captured or rendered. Treat commit message content as untrusted input and monitor for characters that fall outside expected tracker ID formats. Restrict commit access to tracked materials to trusted personnel only.

2. Patch / upgrade steps. The vulnerability is fixed in GoCD 26.1.0. Upgrade all affected instances running 18.3.0 through 26.0.x to 26.1.0 or later. Validate after upgrading that the fix is applied in the target environment and re-review Tracking Tool regex configurations for residual leniency.

3. Long-term hardening. Enforce least privilege on repository and pipeline access so that commit rights are not over-provisioned. Adopt output-encoding standards for any user- or commit-sourced content rendered in the GoCD UI. Maintain a vulnerability management process for CI/CD and build infrastructure, which is a high-value supply-chain target, and monitor vendor advisories for follow-up fixes.

References

• NVD — CVE-2026-52741: https://nvd.nist.gov/vuln/detail/CVE-2026-52741
• GoCD project (vendor) release/advisory channel: https://github.com/gocd/gocd/releases
• CWE-80 — Improper Neutralization of Script-Related HTML Tags: https://cwe.mitre.org/data/definitions/80.html
• MITRE ATT&CK T1189 — Drive-by Compromise: https://attack.mitre.org/techniques/T1189/
• No public proof-of-concept, exploit code, or Nuclei template is currently known; no CISA KEV listing or threat-actor campaign has been attributed to this CVE.