CVE-2026-26195

Published: Mar 5, 2026Modified: Jun 17, 2026

6.9

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security-advisories@github.com (Secondary)

Description

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, stored xss is still possible through unsafe template rendering that mixes user input with safe plus permissive sanitizer handling of data urls. This issue has been patched in version 0.14.2.

Affected (1)

Products: Gogs: Gogs

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gogs Gogs	Before 0.14.2

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://github.com/gogs/gogs/commit/ac21150a53bef3a3061f4da787ab193a8d68ecfc

Source: security-advisories@github.com

Patch

https://github.com/gogs/gogs/pull/8176

Source: security-advisories@github.com

Issue Tracking

https://github.com/gogs/gogs/releases/tag/v0.14.2

Source: security-advisories@github.com

Release Notes

https://github.com/gogs/gogs/security/advisories/GHSA-vgvf-m4fw-938j

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.