Medium · 6.1 CVE-2022-29947 EUVD-2022-1841GHSA-vmp5-c5hp-6c65GO-2022-0440

Woodpecker allows cross-site scripting (XSS) via build logs

Published Apr 29, 2022 · Updated Aug 3, 2024 · Assigned by mitre

Description

Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.

Ecosystem	Package	Affected	Fixed	Record
Go	github.com/woodpecker-ci/woodpecker	< 0.15.1	0.15.1	GHSA-vmp5-c5hp-6c65