QwikSec

Security Database

CVE

CWE

Training

CVE-2026-26022

Published: Mar 5, 2026

Modified: Mar 10, 2026

PUBLISHED

CVSS v3.1

8.7

HIGH

Description

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, a stored cross-site scripting (XSS) vulnerability exists in the comment and issue description functionality. The application's HTML sanitizer explicitly allows data: URI schemes, enabling authenticated users to inject arbitrary JavaScript execution via malicious links. This issue has been patched in version 0.14.2.

Vendor	Product	Versions
gogs	gogs	affected `< 0.14.2`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

References

https://github.com/gogs/gogs/security/advisories/GHSA-xrcr-gmf5-2r8j

x_refsource_CONFIRM

https://github.com/gogs/gogs/pull/8174

x_refsource_MISC

https://github.com/gogs/gogs/commit/441c64d7bd8893b2f4e48660a8be3a7472e14291

x_refsource_MISC

https://github.com/gogs/gogs/releases/tag/v0.14.2

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.