Gocd vulnerabilities
We track 7 vulnerabilities in Gocd products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on September 21, 2026.
Latest Gocd vulnerabilities
- 7.0 High severity
gocd: Improper Neutralization of Script-Related HTML Tags in a Web Page
GoCD is a continuous deliver server. From 13.3.0 until 26.1.0, GoCD does not correctly encode and escape malicious material modification comments that mimic the special trackback format used by package materials when rendering the Stage Detail, Job/Build Detai
- 7.5 High severity
gocd: Improper Neutralization of Script-Related HTML Tags in a Web Page
GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenient Tracking Tool regular expression with an ID capturing group, such as JIRA-(.+). An attacker with c
- 7.1 High severity
gocd: Improper Restriction of XML External Entity Reference
GoCD is a continuous deliver server. GoCD versions prior to 24.4.0 can allow GoCD "group admins" to abuse ability to edit the raw XML configuration for groups they administer to trigger XML External Entity (XXE) injection on the GoCD server. Theoretically, the
- 7.2 High severity
gocd: Improper Restriction of XML External Entity Reference
GoCD is a continuous deliver server. GoCD versions 16.7.0 through 24.4.0 (inclusive) can allow GoCD admins to abuse a hidden/unused configuration repository (pipelines as code) feature to allow XML External Entity (XXE) injection on the GoCD Server which will
- 8.8 High severity
gocd: Improper Authorization
GoCD is a continuous deliver server. GoCD versions prior to 24.5.0 are vulnerable to admin privilege escalation due to improper authorization of access to the admin "Configuration XML" UI feature, and its associated API. A malicious insider/existing authentica
- 8.8 High severity
gocd: Deserialization of Untrusted Data
GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions prior to 21.1.0 are vulnerable to remote code execution on the server from a malicious or compromis
- 8.8 High severity
gocd: Improper Neutralization of Special Elements used in a Command
GoCD is a continuous delivery server. In GoCD versions prior to 22.1.0, it is possible for existing authenticated users who have permissions to edit or create pipeline materials or pipeline configuration repositories to get remote code execution capability on