PT-2026-55302 · Forgejo · Forgejo

George Chen · Published 2026-07-02 · Updated 2026-07-02 · CVE-2026-59102

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Forgejo versions prior to 15.0.3

Description Authenticated attackers can execute arbitrary JavaScript in the browsers of other users. This occurs when the DEFAULT SHOW FULL NAME option is enabled and an attacker sets a full name containing an HTML payload. The issue arises because a server-side translation function fails to escape arguments when assembling the run description for an Actions run, and the frontend subsequently renders this content using a Vue v-html binding, which allows the execution of the injected script when a user views the affected Actions run page.

Recommendations Update to version 15.0.3 or later. Disable the DEFAULT SHOW FULL NAME option as a temporary mitigation measure.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-59102

Affected Products

Forgejo

References · 7

• 🔥 https://github.com/geo-chen/oss/blob/main/forgejo.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-59102 · Security Note
• https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/15.0.3.md · Patch
• https://twitter.com/CVEnew/status/2072814580791914909 · Twitter Post
• https://twitter.com/infoflowcloud/status/2072815475512217987 · Twitter Post
• https://vulncheck.com/advisories/forgejo-stored-xss-via-actions-run-full-name-rendering · Note
• https://codeberg.org/forgejo/forgejo/pulls/13002 · Note