CVE-2026-26195

Gogs: Stored XSS in branch and wiki views through author and committer names

CVSS 6.9 MEDIUMEPSS 0.2%CWE-79

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, stored xss is still possible through unsafe template rendering that mixes user input with safe plus permissive sanitizer handling of data urls. This issue has been patched in version 0.14.2.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Produtos afetados

gogs · gogs

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/gogs/gogs/commit/ac21150a53bef3a3061f4da787ab193a8d68ecfc https://github.com/gogs/gogs/pull/8176 https://github.com/gogs/gogs/releases/tag/v0.14.2 https://github.com/gogs/gogs/security/advisories/GHSA-vgvf-m4fw-938j