# CVE-2026-26022: gogs XSS — Fixed in 0.14.2

🐹

🐹 Go

Not in CISA KEV

HIGH severity

# CVE-2026-26022 — gogs

HIGH [Fix: gogs/gogs@441c64d](https://github.com/gogs/gogs/commit/441c64d7bd8893b2f4e48660a8be3a7472e14291)

CVE-2026-26022 is a high-severity (CVSS 8.7) Cross-site Scripting (XSS) vulnerability in gogs.io/gogs. A fix is available for gogs.io/gogs — see the affected versions and patch details below.

Gogs: Stored XSS via data URI in issue comments

Also known as[GHSA-xrcr-gmf5-2r8j](/vulnerability/GHSA-xrcr-gmf5-2r8j)GO-2026-4620

Published

Mar 5, 2026

Updated

Oct 28, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Nov 9, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

## Exploitation Status

### Proof-of-concept exploit code exists

-   CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
-   A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-26022.

## EPSS Exploitation Probability

[via FIRST.org ↗](https://www.first.org/epss/)

0.4%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs29th percentile — riskier than 29% of all scored CVEsHighest risk

0.00%0.31%0.61%0.92%0.0%0.4%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/).

## How urgent is this, really

## Where this sits among everything scored

## Real-World Exposure

1 pkg affected

🐹`gogs.io/gogs`

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

## Description

#### Summary

A Stored Cross-site Scripting (XSS) vulnerability exists in the comment and issue description functionality. The application's HTML sanitizer explicitly allows `data:` URI schemes, enabling authenticated users to inject arbitrary JavaScript execution via malicious links.

#### Details

The vulnerability is located in `internal/markup/sanitizer.go`. The application uses the `bluemonday` HTML sanitizer but explicitly weakens the security policy by allowing the `data` URL scheme:

```
// internal/markup/sanitizer.go
func NewSanitizer() {
    sanitizer.init.Do(func() {
        // ...
        // Data URLs
        sanitizer.policy.AllowURLSchemes("data")
        // ...
    })
}
```

While the Markdown renderer rewrites relative links (mitigating standard Markdown `[link](data:...)` attacks), Gogs supports **Raw HTML** input. Raw HTML anchor tags bypass the Markdown parser's link rewriting and are processed directly by the sanitizer. Since the sanitizer is configured to allow `data:` URIs, payloads like `<a href="data:text/html...">` are rendered as-is.

#### PoC

1.  Create a file named `exploit.md` in a repository.
2.  Add the following content (Raw HTML):
    
    ```
    <a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=">Click me for XSS</a>
    ```
    
3.  Commit and push the file.
4.  Navigate to the file in the Gogs web interface.
5.  Click the "Click me for XSS" link.
6.  **Result:** An alert box with "XSS" appears, executing the JavaScript payload.

#### Impact

This is a **Stored XSS** vulnerability. Any user who views the malicious comment and clicks the link will execute the attacker-supplied JavaScript in their browser context. This allows attackers to:

-   Steal authentication cookies and session tokens.
-   Perform arbitrary actions on behalf of the victim (e.g., modifying repositories, adding collaborators).
-   Redirect users to malicious sites.

## Affected Packages

1 total 1 fixed

Ecosystem

Package

Vulnerable range

Fix

🐹Go

`gogs.io/gogs` 

all versions

0.14.2`go get gogs.io/gogs@v0.14.2`

## Affected Products

1 product · 1 configurations

Application

`gogs`gogs

< 0.14.2

range

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for gogs.io/gogs, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Fix
    
    Update gogs.io/gogs to 0.14.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-26022 is resolved across your whole dependency graph.
    
3.  ### Workarounds
    
    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.
    

## Frequently Asked Questions

\### Summary A Stored Cross-site Scripting (XSS) vulnerability exists in the comment and issue description functionality. The application's HTML sanitizer explicitly allows \`data:\` URI schemes, enabling authenticated users to inject arbitrary JavaScript execution via malicious links. ### Details The vulnerability is located in \`internal/markup/sanitizer.go\`. The application uses the \`bluemonday\` HTML sanitizer but explicitly weakens the security policy by allowing the \`data\` URL scheme: \`\`\`go // internal/markup/sanitizer.go func NewSanitizer() { sanitizer.init.Do(func() { // ...

O3 Security · Impact-Aware SCA

### Is CVE-2026-26022 in your dependencies?

Find it across Go, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)