CVE-2026-52741

GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenient Tracking Tool regular expression with an ID capturing group, such as JIRA-(.+). An attacker with commit access to a tracked material can place URI or HTML special characters in a matching commit comment, causing stored cross-site scripting when a victim views an affected Compare Pipeline page. Deployments without Tracking Tool integration, without an ID capturing group, or with conservative matchers that cannot match special characters are not affected. Successful exploitation can expose a privileged user session or allow changes using the victim's credentials and privileges. This issue is fixed in version 26.1.0.

• CWE-80

• https://github.com/gocd/gocd/commit/1adba7ded0b9ef57e29f1de876a882199e5da1d4
• https://github.com/gocd/gocd/pull/14356
• https://github.com/gocd/gocd/releases/tag/26.1.0
• https://github.com/gocd/gocd/security/advisories/GHSA-hj3c-q23m-fxcg
• https://www.gocd.org/releases/#26-1-0

Published

Sep 21, 2026

Last Modified

Sep 24, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-52736ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5…8.7
• CVE-2026-52737ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5…5.3
• CVE-2026-52738ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5…6.9
• CVE-2026-52739ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5…5.9
• CVE-2026-5274Integer overflow in Codecs in Google Chrome prior to 146.0.7…8.8
• CVE-2026-52740GoCD is a continuous deliver server. From 18.7.0 until 26.1.…5.3
• CVE-2026-52742GoCD is a continuous deliver server. From 12.3.1 until 26.1.…5.1
• CVE-2026-52743GoCD is a continuous deliver server. Prior to 26.1.0, the in…4.3
• CVE-2026-52744GoCD is a continuous deliver server. From 20.2.0 until 26.1.…5.3
• CVE-2026-52745CordysCRM is an open source AI-powered customer relationship…5.3
• CVE-2026-52746JSONata is a JSON query and transformation language. Prior t…7.5
• CVE-2026-52747ModSecurity is an open source, cross platform web applicatio…8.6