{"id":"GHSA-26gq-grmh-6xm6","aliases":["GO-2026-4454"],"url":"https://o3.security/vulnerability/GHSA-26gq-grmh-6xm6","summary":"Gogs vulnerable to Stored XSS via Mermaid diagrams","details":"### Summary\nStored XSS via mermaid diagrams due to usage of vulnerable renderer library\n\n### Details\nGogs introduced support for rendering mermaid diagrams in version [0.13.0.](https://github.com/gogs/gogs/releases/tag/v0.13.0)\n\nCurrently used version of the library [mermaid 11.9.0](https://github.com/gogs/gogs/tree/main/public/plugins/mermaid-11.9.0) is vulnerable to at least two XSS scenarios with publicly available payloads\n\nResources:\nhttps://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh\nhttps://github.com/mermaid-js/mermaid/security/advisories/GHSA-8gwm-58g9-j8pw\n\n### PoC\n\n1. Create a markdown file eg. `README.md` containing following malicious mermaid diagram (payload based on [CVE-2025-54880](https://github.com/mermaid-js/mermaid/security/advisories/GHSA-8gwm-58g9-j8pw))\n```\narchitecture-beta\n    group api(cloud)[API]\n    service db \"<img src=x onerror=\\\"alert(document.domain)\\\">\" [Database] in api\n```\n2. The XSS should pop whenever either repository or file is viewed\n\n#### Demo\n\nhttps://github.com/user-attachments/assets/98320f62-6c1c-4254-aa61-95598c725235\n\n### Impact\nThe attacker can potentially achieve account takeover\nIn a worst case scenario if the victim were an instance admin this could lead to a compromise of the entire deployment\n\n### Proposed remediation steps\n1. Upgrade to a patched version of the third party library\nhttps://github.com/mermaid-js/mermaid/releases/tag/v10.9.5\n2. Consider running mermaid using `sandbox` level which would mitigate impact of future potential cross-site scripting issues\nhttps://mermaid.js.org/config/usage.html#securitylevel","published":"2026-02-06T19:44:14Z","modified":"2026-02-19T20:41:26.142855Z","cvss":{"score":7.3,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"gogs.io/gogs","fixedVersion":"0.13.4"}],"fix":{"url":"https://github.com/gogs/gogs/commit/71a72a72ad1c8cea7940c9d7e4cbdfbc0fc3d401","label":"gogs/gogs@71a72a7"},"references":[{"type":"WEB","url":"https://github.com/gogs/gogs/security/advisories/GHSA-26gq-grmh-6xm6"},{"type":"WEB","url":"https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh"},{"type":"WEB","url":"https://github.com/mermaid-js/mermaid/security/advisories/GHSA-8gwm-58g9-j8pw"},{"type":"WEB","url":"https://github.com/gogs/gogs/commit/71a72a72ad1c8cea7940c9d7e4cbdfbc0fc3d401"},{"type":"PACKAGE","url":"https://github.com/gogs/gogs"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-02-19T20:41:26.142855Z"}}