# CVE-2026-26195: gogs XSS

🐹 Go

Not in CISA KEV

# CVE-2026-26195 — gogs

[Fix: gogs/gogs@ac21150](https://github.com/gogs/gogs/commit/ac21150a53bef3a3061f4da787ab193a8d68ecfc)

CVE-2026-26195 is a Cross-site Scripting (XSS) vulnerability in gogs.io/gogs. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.

Gogs: Stored XSS in branch and wiki views through author and committer names

Also known as[GHSA-vgvf-m4fw-938j](/vulnerability/GHSA-vgvf-m4fw-938j)GO-2026-4618

Published

Mar 5, 2026

Updated

Oct 28, 2026

Affected

1 pkg

Patched

See advisory

Exploits

None indexed

Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

## Exploitation Status

### No confirmed exploitation observed yet

-   CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
-   CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-26195.

## EPSS Exploitation Probability

[via FIRST.org ↗](https://www.first.org/epss/)

0.2%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs13th percentile — riskier than 13% of all scored CVEsHighest risk

0.00%0.28%0.55%0.83%0.0%0.2%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/).

## Real-World Exposure

1 pkg affected

🐹`gogs.io/gogs`

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

## Description

#### Summary

Stored XSS is still possible through unsafe template rendering that mixes user input with `safe()` plus permissive sanitizer handling of data URLs.

#### Details

`safe()` still turns off escaping:

-   internal/template/template.go
-   `func safe(raw string) template.HTML { return template.HTML(raw) }`

Branch pages still render committer names using `safe()`:

-   templates/repo/branches/overview.tmpl
-   templates/repo/branches/all.tmpl
-   templates/repo/wiki/view.tmpl

The locale still injects a raw second argument: conf/locale/locale\_en-US.ini (`branches.updated_by = updated %[1]s by %[2]s`)

#### Impact

An attacker who can inject commit metadata such as author/committer name can trigger script execution on affected pages, leading to session abuse, CSRF token theft, or unauthorized actions.

#### Recommended Fix

-   Untrusted arguments should be escaped before being used in translations.
-   Data URLs should be limited or blocked in the sanitizer.

#### Remediation

A fix is available at [https://github.com/gogs/gogs/releases/tag/v0.14.2](https://github.com/gogs/gogs/releases/tag/v0.14.2).

## Affected Packages

1 total

Ecosystem

Package

Vulnerable range

Fix

🐹Go

`gogs.io/gogs` 

all versions

No fix

## Affected Products

1 product · 1 configurations

Application

`gogs`gogs

< 0.14.2

range

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for gogs.io/gogs, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Remediation status
    
    The records we use list no patched version of gogs.io/gogs for CVE-2026-26195. Check the maintainer's advisory, and where your build allows, override or pin the dependency away from the vulnerable range.
    
3.  ### Mitigate without a patch
    
    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.
    

## Frequently Asked Questions

\### Summary Stored XSS is still possible through unsafe template rendering that mixes user input with \`safe()\` plus permissive sanitizer handling of data URLs. ### Details \`safe()\` still turns off escaping: - internal/template/template.go - \`func safe(raw string) template.HTML { return template.HTML(raw) }\` Branch pages still render committer names using \`safe()\`: - templates/repo/branches/overview.tmpl - templates/repo/branches/all.tmpl - templates/repo/wiki/view.tmpl The locale still injects a raw second argument: conf/locale/locale\_en-US.ini (\`branches.updated\_by = updated %\[1\]s by %\[2

O3 Security · Impact-Aware SCA

### Is CVE-2026-26195 in your dependencies?

Find it across Go, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)