PT-2026-23484 · Gogs · Gogs

Dxleryt

·

Published

2026-02-11

·

Updated

2026-03-25

·

CVE-2026-26022

CVSS v3.1

8.7

High

VectorAV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.2
Description Gogs, a self-hosted Git service, contains a stored cross-site scripting (XSS) issue in the comment and issue description functionality. The HTML sanitizer allows data: URI schemes, enabling authenticated users to inject arbitrary JavaScript execution through malicious links. The vulnerability resides in the internal/markup/sanitizer.go file, where the bluemonday HTML sanitizer is configured to allow data URLs. Raw HTML anchor tags bypass the Markdown parser and are processed directly by the sanitizer, allowing payloads like <a href="data:text/html..."> to be rendered. Exploitation involves creating a file with malicious HTML content, committing and pushing it to a repository, and then clicking the link in the Gogs web interface. Successful exploitation allows attackers to steal authentication cookies, perform actions on behalf of the victim, or redirect users to malicious sites.
Recommendations Versions prior to 0.14.2 should be updated to version 0.14.2 or later.

Exploit

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2026-06150
CVE-2026-26022
GHSA-XRCR-GMF5-2R8J
GO-2026-4620
SUSE-SU-2026:1042-1

Affected Products

Gogs