GoCD can generate unescaped tracking‑tool links from commit comments when a project uses a lenient regular expression that captures an ID, such as JIRA-(.+). If an attacker with commit access injects URI or HTML special characters into a matching comment, the resulting link is stored and rendered when a victim views an affected Compare Pipeline page. The stored cross‑site scripting can expose the victim’s privileged session or allow the attacker to perform actions on the victim’s behalf. There is no known environment restriction beyond the need for commit‑level write access to a tracked material.

The vulnerability affects GoCD servers from release 18.3.0 up to but excluding version 26.1.0. Servers that include a tracking‑tool integration, use an ID‑capturing group in the regular expression, and allow special characters in match results are impacted. Deployments that do not use Tracking Tool integration, omit the capturing group, or use conservative matchers that block special characters are not affected.

With a CVSS score of 7.5 the vulnerability is considered high risk. The EPSS score is not available, so the current exploitation probability is unknown. It is not listed in the CISA KEV catalog. Attacks would require the attacker to be able to add or modify a commit comment in a tracked material; once a victim views the page the malicious script is executed in the victim’s browser context. This can lead to session hijacking or privilege escalation within the GoCD environment.