CVE-2026-68919

Name of the Vulnerable Software and Affected Versions GoCD versions 13.3.0 through 26.0.x

Description GoCD fails to correctly encode and escape malicious material modification comments that mimic the special trackback format used by package materials. This occurs when rendering the Stage Detail, Job/Build Detail, Value Stream Map, and Pipeline History views. A user with write access to a material tracked by GoCD can store arbitrary HTML or JavaScript in a forged package material comment. This content executes in the browser session of a user who views an affected page, potentially exposing a privileged user session or allowing unauthorized changes using the victim's credentials and privileges.

Recommendations Update to version 26.1.0.