HIGH8.1Go
GHSA-4gcf-5m39-98mc· CVE-2023-40034, GO-2023-2014Woodpecker does not validate webhook before changing any data
Modified: 9/10/2026
package
Go/github.com/woodpecker-ci/woodpecker
pkg:go/github.com/woodpecker-ci/woodpecker
HIGHGo
GHSA-qf34-295c-26v8· CVE-2026-61549, GO-2026-5992Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend
Modified: 7/21/2026
MEDIUM6.1Go
GHSA-vmp5-c5hp-6c65· CVE-2022-29947, GO-2022-0440Woodpecker allows cross-site scripting (XSS) via build logs
Modified: 8/21/2024
—Go
GO-2022-0440· CVE-2022-29947, GHSA-vmp5-c5hp-6c65Woodpecker allows cross-site scripting (XSS) via build logs in github.com/woodpecker-ci/woodpecker
Modified: 3/3/2026
—Go
GO-2023-2014· CVE-2023-40034, GHSA-4gcf-5m39-98mcWoodpecker does not validate webhook before changing any data in github.com/woodpecker-ci/woodpecker
Modified: 3/3/2026
—Go
GO-2026-5992· CVE-2026-61549, GHSA-qf34-295c-26v8Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend in github.com/woodpecker-ci/woodpecker
Modified: 7/21/2026