Stored XSS in Gogs Self-Hosted Git Service

Compliance Impact

CVE-2026-52807 is a stored Cross-Site Scripting (XSS) vulnerability that allows an attacker to execute arbitrary JavaScript in the context of a user's session by injecting malicious code into milestone names. This can lead to session hijacking and unauthorized actions performed as the victim.

Such vulnerabilities can impact compliance with standards like GDPR and HIPAA because they may lead to unauthorized access to personal or sensitive data through session hijacking or other malicious actions. If an attacker exploits this vulnerability, it could result in data breaches or unauthorized data processing, which are violations of these regulations.

Therefore, organizations using affected versions of Gogs prior to 0.14.3 may face increased risk of non-compliance with data protection and privacy regulations unless the vulnerability is mitigated by applying the patch that sanitizes milestone names.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves stored Cross-Site Scripting (XSS) in milestone names within the Gogs application. Detection involves identifying if any milestone names contain malicious HTML or JavaScript payloads that could be executed when interacting with the milestone dropdown on the New Issue page.

To detect this vulnerability on your system, you can inspect the milestone names stored in your Gogs repositories for suspicious HTML or JavaScript code, such as tags with event handlers (e.g., <img src=x onerror=alert(1)>).

Since the vulnerability triggers when a user interacts with the milestone dropdown, you can also monitor or test the New Issue page in affected versions (prior to 0.14.3) by selecting milestones and observing if any unexpected script execution occurs.

There are no specific network commands provided in the resources, but you can use the following approaches:

• Query the Gogs database or API to list milestone names and search for suspicious HTML or JavaScript patterns.
• Use browser developer tools or automated testing tools (e.g., Burp Suite, OWASP ZAP) to interact with the milestone dropdown and detect if scripts execute unexpectedly.
• Check the Gogs version; if it is prior to 0.14.3, the system is vulnerable and should be updated.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Gogs, an open source self-hosted Git service, prior to version 0.14.3. It involves how milestone names are rendered and handled in the New Issue page. Although milestone names are initially auto-escaped to prevent direct HTML injection, the browser decodes the text content. Semantic UI's dropdown component, which is used for milestone selection, has a default setting called preserveHTML: true. When a user interacts with the milestone dropdown, the decoded text is re-parsed as HTML by jQuery's .html() method, allowing any embedded HTML or JavaScript payload to execute. This means an attacker can store malicious code in a milestone name, which will run in the browser of any user who opens the New Issue page and interacts with the dropdown.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker to execute arbitrary JavaScript code in the browsers of users who interact with the milestone dropdown on the New Issue page. This can lead to cross-site scripting (XSS) attacks, potentially enabling the attacker to steal user session data, perform actions on behalf of the user, or deliver malicious payloads. Since the attack requires user interaction with the dropdown, it relies on social engineering or user activity to trigger the payload.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Gogs to version 0.14.3 or later, where the issue has been fixed.

Useful 0 Not Useful 0