CVE-2026-26022 — Cross-site Scripting in Gogs

CWE-79 — Cross-site ScriptingCWE-184 — Incomplete List of Disallowed Inputs23 documents4 sources
Severity
5.4MEDIUMNVD
EPSS
0.0%
top 96.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Gogs.io GogsGogsUnjs Unhead
Timeline
PublishedMar 5
Latest updateApr 9

Description

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, a stored cross-site scripting (XSS) vulnerability exists in the comment and issue description functionality. The application's HTML sanitizer explicitly allows data: URI schemes, enabling authenticated users to inject arbitrary JavaScript execution via malicious links. This issue has been patched in version 0.14.2.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶NVDgogs/gogs< 0.14.2
▶Gogogs.io/gogs< 0.14.2
▶npmunjs/unhead< 2.1.13

Patches

Patch: github.com ↗

🔴Vulnerability Details

5
OSV
Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()↗2026-04-09
▶
GHSA
Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()↗2026-04-09
▶
OSV
Gogs: Stored XSS via data URI in issue comments in gogs.io/gogs↗2026-03-10
▶
GHSA
Gogs: Stored XSS via data URI in issue comments↗2026-03-05
▶
OSV
Gogs: Stored XSS via data URI in issue comments↗2026-03-05
▶

🕵️Threat Intelligence

17
Wiz
CVE-2026-26196 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-24135 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-25921 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-22592 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-26022 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶