Browse all 3 CVE security advisories affecting woodpecker-ci. AI-powered Chinese analysis, POCs, and references for each vulnerability.
Woodpecker-CI is a self-hosted continuous integration and delivery platform designed for automating software builds and deployments. Historically, it has been vulnerable to multiple remote code execution (RCE) flaws, cross-site scripting (XSS) issues, and privilege escalation vulnerabilities. These weaknesses often stem from improper input validation and insufficient access controls in its web interface and API. While no major public security incidents have been widely documented, the three CVEs on record highlight potential risks for organizations deploying this tool, particularly in environments where untrusted users could interact with the system or where default configurations remain unchanged.
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2024-41122 | Custom environment variables allow to alter execution flow of plugins in Woodpecker — woodpeckerCWE-74 | 7.5 | High | 2024-07-19 |
| CVE-2024-41121 | Custom workspace allow to overwrite plugin entrypoint executable in Woodpecker — woodpeckerCWE-74 | 8.8 | High | 2024-07-19 |
| CVE-2023-40034 | Repositoty takeover in woodpecker-ci — woodpeckerCWE-20 | 8.1 | High | 2023-08-16 |
This page lists every published CVE security advisory associated with woodpecker-ci. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.