PT-2026-51130 · Gogs+1 · Gogs+1

Published 2026-06-20 · Updated 2026-06-22 · CVE-2026-52798

Positive Technologies (AI Summary)

CVSS v3.1

8.9

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Gogs (affected versions not specified)

Description A stored cross-site scripting issue exists due to the use of an outdated notebookjs library. While .ipynb previews are sanitized on the server side via the '/-/api/sanitize ipynb' endpoint, content within elements with the .nb-markdown-cell class is re-rendered on the client side using the marked() function without further sanitization. This allows links containing the javascript: scheme to be regenerated. An attacker can commit a crafted .ipynb file to a repository; when a victim views the file and clicks the malicious link, arbitrary JavaScript is executed within the Gogs origin. This can lead to unauthorized actions using the victim's account privileges, theft of sensitive information, or instance-wide configuration changes if the victim is an administrator.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-52798

GHSA-JQ8V-RMF6-65JW

Affected Products

Gogs

Notebookjs

References · 7

• https://osv.dev/vulnerability/GHSA-jq8v-rmf6-65jw · Vendor Advisory
• https://github.com/gogs/gogs/commit/17b168b11ca759a7550e1f4bbd68bbde14db7785 · Note
• https://github.com/gogs/gogs/security/advisories/GHSA-jq8v-rmf6-65jw · Note
• https://github.com/gogs/gogs/releases/tag/v0.14.3 · Note
• https://github.com/gogs/gogs/pull/8319 · Note
• https://github.com/gogs/gogs · Note
• https://twitter.com/dailycve/status/2068131266566799626 · Twitter Post