← Vulnerability feed

Vulnerability record · CVE-2022-29184 · published 20 May 2022

CVE-2022-29184: Thoughtworks gocd command injection vulnerability

Thoughtworks · Gocd

GoCD is a continuous delivery server. In GoCD versions prior to 22.1.0, it is possible for existing authenticated users who have permissions to edit or create pipeline materials or pipeline configuration repositories to get remote code execution capability on the GoCD server via configuring a malicious branch name which abuses Mercurial hooks/aliases to exploit a command injection weakness. An attacker would require access to an account with existing GoCD administration permissions to either create/edit (`hg`-based) configuration repositories; create/edit pipelines and their (`hg`-based) materials; or, where "pipelines-as-code" configuration repositories are used, to commit malicious configuration to such an external repository which will be automatically parsed into a pipeline configuration and (`hg`) material definition by the GoCD server. This issue is fixed in GoCD 22.1.0. As a workaround, users who do not use/rely upon Mercurial materials can uninstall/remove the `hg`/Mercurial binary from the underlying GoCD Server operating system or Docker image.

8.8 CVSS 3.1 High EPSS 3.8% · top 10.4% CWE-77 · Command injectionCWE-88 · Argument injection
8.8CVSS 3.1 base score, v2 6.5
3.8%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

GoCD is a continuous delivery server. In GoCD versions prior to 22.1.0, it is possible for existing authenticated users who have permissions to edit or create pipeline materials or pipeline configuration repositories to get remote code execution capability on the GoCD server via configuring a malicious branch name which abuses Mercurial hooks/aliases to exploit a command injection weakness. An attacker would require access to an account with existing GoCD administration permissions to either create/edit (`hg`-based) configuration repositories; create/edit pipelines and their (`hg`-based) materials; or, where "pipelines-as-code" configuration repositories are used, to commit malicious configuration to such an external repository which will be automatically parsed into a pipeline configuration and (`hg`) material definition by the GoCD server. This issue is fixed in GoCD 22.1.0. As a workaround, users who do not use/rely upon Mercurial materials can uninstall/remove the `hg`/Mercurial binary from the underlying GoCD Server operating system or Docker image.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb PatchThird Party Advisory
https://github.com/gocd/gocd/releases/tag/22.1.0 Release NotesThird Party Advisory
https://github.com/gocd/gocd/security/advisories/GHSA-vf5r-r7j2-cf2h Third Party Advisory
https://www.gocd.org/releases/#22-1-0 Release NotesVendor Advisory
https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb PatchThird Party Advisory
https://github.com/gocd/gocd/releases/tag/22.1.0 Release NotesThird Party Advisory
https://github.com/gocd/gocd/security/advisories/GHSA-vf5r-r7j2-cf2h Third Party Advisory
https://www.gocd.org/releases/#22-1-0 Release NotesVendor Advisory

Track CVE-2022-29184 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-43290Thoughtworks gocd path traversal vulnerabilityAn issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into a directory…EPSS 3.2%9.8CVE-2021-44659Thoughtworks gocd server-side request forgery (ssrf) vulnerabilityAdding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to do an un-intended action in order to achieve a Server…EPSS 2.5%9.4CVE-2024-56320Thoughtworks gocd improper authorization vulnerabilityGoCD is a continuous deliver server. GoCD versions prior to 24.5.0 are vulnerable to admin privilege escalation due to improper authorization of acce…EPSS 0.74%8.8CVE-2022-39311Thoughtworks gocd deserialization of untrusted data vulnerabilityGoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. Go…EPSS 1.7%8.8CVE-2021-43286Thoughtworks gocd command injection vulnerabilityAn issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker with privileges to create a new pipeline on a GoCD server can abuse a command…EPSS 2.9%8.8CVE-2021-25924Thoughtworks gocd cross-site request forgery vulnerabilityIn GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the `/go/api/config/backup` endpoin…EPSS 0.75%7.5CVE-2021-43289Thoughtworks gocd path traversal vulnerabilityAn issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into an arbitrar…EPSS 2.3%7.5CVE-2021-43287Thoughtworks gocd information exposure vulnerabilityAn issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default, leaks all secrets known to t…EPSS 27%

Source: NIST National Vulnerability Database (record CVE-2022-29184), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.