Skip to content
OpenAdvisories

Package · Go

github.com/woodpecker-ci/woodpecker

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Critical 9.0
    CVE-2026-61549

    Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend

    Woodpecker is a CI/CD engine. From 1.0.0 until 3.16.0, pipeline/backend/kubernetes/backend_options.go defines backend_options.kubernetes.serviceAccountName, and the Kubernetes backend in pipeline/backend/kubernetes/pod.go copies that pipeline-step value direc…

    woodpecker-ci woodpecker go.woodpecker-ci.org/woodpecker go.woodpecker-ci.org/woodpecker/v2 Go
  • High 8.1
    CVE-2023-40034

    Repositoty takeover in woodpecker-ci

    Woodpecker is a community fork of the Drone CI system. In affected versions an attacker can post malformed webhook data witch lead to an update of the repository data that can e.g. allow the takeover of an repo. This is only critical if the CI is configured f…

    woodpecker-ci woodpecker github.com/woodpecker-ci/woodpecker Go
  • Medium 6.1
    CVE-2022-29947

    Woodpecker allows cross-site scripting (XSS) via build logs

    Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.

    github.com/woodpecker-ci/woodpecker Go