CVE-2022-31038: medium-severity vulnerability in gogs
XSS vulnerability in repository issue list in Gogs
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Gogs allows attackers to inject malicious scripts into user display names, which are then executed in other users' browsers when viewing issue lists. This can lead to session hijacking or credential theft.
The `DisplayName` field in Gogs prior to 0.12.9 lacks output encoding/sanitization, enabling stored XSS attacks via the issue list interface. An authenticated attacker can inject HTML/JavaScript that executes in victims' browsers with their privileges. The vulnerability requires user interaction (viewing the issue list) and results in account compromise or data exfiltration.
In the same product, most dangerous first.