{"id":"CVE-2022-29184","summary":"Command Injection/Argument Injection in GoCD","details":"GoCD is a continuous delivery server. In GoCD versions prior to 22.1.0, it is possible for existing authenticated users who have permissions to edit or create pipeline materials or pipeline configuration repositories to get remote code execution capability on the GoCD server via configuring a malicious branch name which abuses Mercurial hooks/aliases to exploit a command injection weakness. An attacker would require access to an account with existing GoCD administration permissions to either create/edit (`hg`-based) configuration repositories; create/edit pipelines and their (`hg`-based) materials; or, where \"pipelines-as-code\" configuration repositories are used, to commit malicious configuration to such an external repository which will be automatically parsed into a pipeline configuration and (`hg`) material definition by the GoCD server. This issue is fixed in GoCD 22.1.0. As a workaround, users who do not use/rely upon Mercurial materials can uninstall/remove the `hg`/Mercurial binary from the underlying GoCD Server operating system or Docker image.","aliases":["GHSA-vf5r-r7j2-cf2h"],"modified":"2026-08-12T13:00:55.453174Z","published":"2022-05-20T19:25:14Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-77","CWE-88"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29184.json"},"references":[{"type":"WEB","url":"https://github.com/gocd/gocd/releases/tag/22.1.0"},{"type":"WEB","url":"https://www.gocd.org/releases/#22-1-0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29184.json"},{"type":"ADVISORY","url":"https://github.com/gocd/gocd/security/advisories/GHSA-vf5r-r7j2-cf2h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29184"},{"type":"FIX","url":"https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gocd/gocd","events":[{"introduced":"0"},{"fixed":"f4c9c1650e2e27fe0a9962faa39536f94f57e297"},{"fixed":"37d35115db2ada2190173f9413cfe1bc6c295ecb"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:thoughtworks:gocd:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"22.1.0"}]}}],"versions":["21.4.0","21.3.0","21.2.0","21.1.0","20.10.0","20.9.0","20.8.0","20.7.0","20.6.0","20.5.0","20.4.0","20.3.0","20.2.0","20.1.0","19.12.0","19.11.0","19.10.0","19.9.0","19.8.0","19.7.0","19.6.0","19.5.0","19.4.0","19.3.0","19.2.0","19.1.0","18.12.0","18.11.0","18.10.0","18.9.0","18.8.0","18.7.0","18.6.0","18.5.0","18.4.0","18.3.0","18.2.0","18.1.0","17.12.0","17.11.0","17.10.0","17.9.0","17.8.0","17.7.0","17.6.0","17.5.0","17.4.0","17.3.0","17.2.0","17.1.0","16.12.0","16.11.0","16.10.0","16.9.0","16.8.0","16.7.0","16.6.0","16.5.0","16.4.0","16.3.0","16.2.0","16.1.0","15.3.0","15.2.0","15.1.0","14.4.0","14.3.0","14.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29184.json","vanir_signatures_modified":"2026-08-12T13:00:55Z","vanir_signatures":[{"target":{"file":"domain/src/main/java/com/thoughtworks/go/domain/materials/mercurial/HgCommand.java","function":"modificationsSince"},"deprecated":false,"digest":{"function_hash":"277686828115175160626103866335989489805","length":339},"id":"CVE-2022-29184-075d41c3","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb"},{"target":{"file":"domain/src/main/java/com/thoughtworks/go/domain/materials/mercurial/HgCommand.java","function":"findRecentModifications"},"deprecated":false,"digest":{"function_hash":"41756437660128987505765612648074900919","length":336},"id":"CVE-2022-29184-16d84929","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb"},{"id":"CVE-2022-29184-44403fb9","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb","target":{"file":"common/src/test/java/com/thoughtworks/go/domain/materials/mercurial/HgCommandTest.java","function":"shouldNotGetModificationsFromOtherBranches"},"deprecated":false,"digest":{"function_hash":"45364524151157000305380267180280483645","length":387}},{"id":"CVE-2022-29184-48e90d3b","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb","target":{"file":"domain/src/main/java/com/thoughtworks/go/domain/materials/mercurial/HgCommand.java","function":"checkConnection"},"deprecated":false,"digest":{"function_hash":"20296423806307716788779294493390940686","length":203}},{"deprecated":false,"digest":{"function_hash":"195819977323848723949219172936150138817","length":272},"id":"CVE-2022-29184-4a9ea606","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb","target":{"file":"common/src/test/java/com/thoughtworks/go/domain/materials/mercurial/HgCommandTest.java","function":"shouldThrowExceptionIfUpdateFails"}},{"signature_version":"v1","source":"https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb","target":{"file":"domain/src/main/java/com/thoughtworks/go/domain/materials/mercurial/HgCommand.java","function":"clone"},"deprecated":false,"digest":{"function_hash":"265965133634377081392148788441778707370","length":287},"id":"CVE-2022-29184-54e7f2c9","signature_type":"Function"},{"deprecated":false,"digest":{"length":350,"function_hash":"306989524575135636740696097359008269313"},"id":"CVE-2022-29184-715b6339","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb","target":{"file":"common/src/test/java/com/thoughtworks/go/domain/materials/mercurial/HgCommandTest.java","function":"shouldGetLatestModifications"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb","target":{"file":"common/src/test/java/com/thoughtworks/go/domain/materials/mercurial/HgCommandTest.java","function":"shouldCloneFromRemoteRepo"},"deprecated":false,"digest":{"function_hash":"176402828332043674955076136706488273973","length":96},"id":"CVE-2022-29184-73fb38e7"},{"id":"CVE-2022-29184-785a3a1c","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb","target":{"function":"shouldNotIncludeCommitFromAnotherBranchInGetLatestModifications","file":"common/src/test/java/com/thoughtworks/go/domain/materials/mercurial/HgCommandTest.java"},"deprecated":false,"digest":{"function_hash":"145520766394271776183923797346271546857","length":333}},{"deprecated":false,"digest":{"line_hashes":["99862452430027719910081147550839296330","103625639480383592198915416643930782312","199488466470648879558212759353047545163","133846424447767325109671217211775908699","319079973519767813424683916530779672325","175048437384401087854543873691342474999","301687626271228334475079094274840328728","111447377736944001848332915398839802622","129896359587484341952447036253904410533","55813602740054720036807898462650569485","25975300251896800700010672712162562257","158657086511925862169679072245155689404","145719862768020879567720245810116125715","215910125453702895015980510798282788343","193679241370104892230564555402699912255","213905516100836339604092090947331498308","15280479407438311419666835501291128039","140398798845240316461001514808605714134","260908036667298120381063421141133927132","141219351439798595834322670420400340561","124612989227344696457848356726614070296","118192183312211891524070685300148691702","312740641161522007796730306816107632284","316263195163759202763123278030407729009","305730292505604537276532844472342201962","288062059188498850462952256715354751192","189944871796042697413990790091233864524","183152790747637562169830902265202867830","169459198651268401112080033838372513942","257037923149726238899368433762837882818","140445152693042796762272352753323473588","135184547433740646873405968638829591370","13879130112967971210445332783675964794","170143744587504626175307080821882926458","132201807361622338894939363426000245047","270243584828025414520252145755749404851","87539375011378343653960706090265938797","14534708136508035591563111624332913084","97622748712036927092110412280062670648","59458027138940331803003820933902848024","299947249237432107527830222560665715685","268305481440360634109698797731070285966","127671362428178164019680515446775444594","122749094938931484287106715703011850066","212114508730904533524163100824331100648"],"threshold":0.9},"id":"CVE-2022-29184-7dbb9b2c","signature_type":"Line","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb","target":{"file":"common/src/test/java/com/thoughtworks/go/domain/materials/mercurial/HgCommandTest.java"}},{"digest":{"length":354,"function_hash":"25019327673332204383710143340009606232"},"id":"CVE-2022-29184-8dad0234","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb","target":{"file":"domain/src/main/java/com/thoughtworks/go/domain/materials/mercurial/HgCommand.java","function":"templatePath"},"deprecated":false},{"target":{"function":"shouldThrowExceptionForBadConnection","file":"common/src/test/java/com/thoughtworks/go/domain/materials/mercurial/HgCommandTest.java"},"deprecated":false,"digest":{"function_hash":"181186856904845567293496482563688630985","length":225},"id":"CVE-2022-29184-9bce51da","signature_type":"Function","signature_version":"v1","source":"https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb"},{"signature_version":"v1","source":"https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb","target":{"file":"domain/src/main/java/com/thoughtworks/go/domain/materials/mercurial/HgCommand.java","function":"pull"},"deprecated":false,"digest":{"function_hash":"132321672288271824051512897744815848981","length":195},"id":"CVE-2022-29184-b4ae2ad1","signature_type":"Function"},{"source":"https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb","target":{"file":"domain/src/main/java/com/thoughtworks/go/domain/materials/mercurial/HgCommand.java"},"deprecated":false,"digest":{"line_hashes":["210267668920354936303607642940069050170","330953421107129250925006173871856419843","117388941233977526338368203545979976560","335858727788507751481872018961076273717","103151244510056177135580506240936872730","263902032936920929295103291043503335231","289358396723882523170304895314123792026","84246409819928601517728027197574550512","253170136964569131558334517003358469044","11700514443476027148325822742446592851","113397999953854579418732023686275250176","53482601318655409529032877584216371673","279675351122017986156491083829158687232","101448108246872540339213789477906274607","163211089742704882806326490613762157820","85139259905615528914129915301818860952","315439472601678501093519928230779086136","148010278994894773713670729622151993252","237016048707710917936537910426964105270","225425968430376769302205455756989754675","31091398584587903641009640687874296627","212157060610584044716101722764803315215","239837388635309663427523832415756441041","2543445209339795015400832211819408267","292442778917862568270150239501180538090","267199097621656342054775518555950727718","325284330931153869259029768336146606861","219481154712325788555024983885673330527","204801778847650174113791923797261341759","174702926658126841229006764848148191096","285548623309379140956462594847965898034","49855895862318171065648960312803485848","104994694647776227251747011768905927709","6779959532214371828225208717880741968","221267716087065188218725064356618818099","277334954013557783242122067576758980425","127931839055524378315408783798144474970","40641952937869006545492645599143310233","148158130499221419752834862069973587129","87819578434253566267272185651247222152","240622602603374510796905344920722298368","99992578413186169226735216879355836352","36319406282889696794209181696040869127","22644804770329743107517395777353236325","267266775572531934539436278735158572225","74551928255256161757107381706560322281","164920517632128951182373986886750058415","35543584844430583818555093035288750744","9562807583165632494507531230133546920","39166070765083683408848459641049292663","274450183716863677251786186380597750951","224990284865345248672772138424631456433","171872121939947935968431160379188910857","191645551556644993591645221290690478786","69032822509006505870280062337023881310","246095451335979716646128747335448775439","151510232770011198534705437699164516393","16895367694114151147756485951983966043","318175227882801580340823583660214675322"],"threshold":0.9},"id":"CVE-2022-29184-dfd63cfc","signature_type":"Line","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}