PT-2026-23488 · Gogs · Gogs

Odgrso · Published 2026-02-19 · Updated 2026-03-25 · CVE-2026-26276

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.2

Description Gogs, a self-hosted Git service, is affected by a DOM-Based Cross-Site Scripting (XSS) issue. An attacker can inject an HTML/JavaScript payload into a repository’s Milestone name. When another user selects this Milestone on the New Issue page (/issues/new), the malicious script is executed, potentially leading to information theft, CSRF token extraction, and unauthorized repository operations. The impact scope depends on the victim’s permission level. The vulnerable parameter is the Milestone name.

Recommendations Update to version 0.14.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-06149

CVE-2026-26276

GHSA-VGJM-2CPF-4G7C

GO-2026-4627

SUSE-SU-2026:1042-1

Affected Products

Gogs

References · 140

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26276.json · Exploit
• https://github.com/gogs/gogs/security/advisories/GHSA-vgjm-2cpf-4g7c · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vgjm-2cpf-4g7c · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06149 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-26276 · Security Note
• https://osv.dev/vulnerability/GO-2026-4627 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26276 · Vendor Advisory
• https://github.com/gogs/gogs · Note
• https://github.com/gogs/gogs/commit/9001a68cdda7bd9c078ffd6d1c4622905ac11e5c · Note
• https://github.com/gogs/gogs/releases/tag/v0.14.2 · Note
• https://github.com/gogs/gogs/pull/8178 · Note
• https://suse.com/security/cve/CVE-2026-28789 · Note
• https://suse.com/security/cve/CVE-2026-27896 · Note
• https://suse.com/security/cve/CVE-2026-28280 · Note