CVE-2021-43286

An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker with privileges to create a new pipeline on a GoCD server can abuse a command-line injection in the Git URL "Test Connection" feature to execute arbitrary code.

• CWE-77

• https://blog.sonarsource.com/gocd-vulnerability-chainExploit, Patch, Third Party Advisory
• https://github.com/gocd/gocd/commit/2b77b533abcbb79c8fc758dec9984305dc1ade42Patch, Third Party Advisory
• https://github.com/gocd/gocd/commit/6fa9fb7a7c91e760f1adc2593acdd50f2d78676bPatch, Third Party Advisory
• https://www.gocd.org/releases/#21-3-0Issue Tracking, Release Notes, Vendor Advisory
• https://blog.sonarsource.com/gocd-vulnerability-chainExploit, Patch, Third Party Advisory
• https://github.com/gocd/gocd/commit/2b77b533abcbb79c8fc758dec9984305dc1ade42Patch, Third Party Advisory
• https://github.com/gocd/gocd/commit/6fa9fb7a7c91e760f1adc2593acdd50f2d78676bPatch, Third Party Advisory
• https://www.gocd.org/releases/#21-3-0Issue Tracking, Release Notes, Vendor Advisory

Published

Apr 14, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-4328A vulnerability has been found in 狮子鱼CMS and classified as c…9.8
• CVE-2021-43280A stack-based buffer overflow vulnerability exists in the DW…7.8
• CVE-2021-43281MyBB before 1.8.29 allows Remote Code Injection by an admin …7.2
• CVE-2021-43282An issue was discovered on Victure WR1200 devices through 1.…6.5
• CVE-2021-43283An issue was discovered on Victure WR1200 devices through 1.…8.8
• CVE-2021-43284An issue was discovered on Victure WR1200 devices through 1.…7.8
• CVE-2021-43287An issue was discovered in ThoughtWorks GoCD before 21.3.0. …7.5
• CVE-2021-43288An issue was discovered in ThoughtWorks GoCD before 21.3.0. …5.4
• CVE-2021-43289An issue was discovered in ThoughtWorks GoCD before 21.3.0. …7.5
• CVE-2021-4329A vulnerability, which was classified as critical, has been …9.8
• CVE-2021-43290An issue was discovered in ThoughtWorks GoCD before 21.3.0. …9.8
• CVE-2021-43293Sonatype Nexus Repository Manager 3.x before 3.36.0 allows a…4.3