CVE-2026-26276
📋 TL;DR
This CVE describes a DOM-based cross-site scripting (XSS) vulnerability in Gogs self-hosted Git service. Attackers can inject malicious JavaScript into milestone names, which executes when users create new issues. All Gogs instances running versions before 0.14.2 are affected.
💻 Affected Systems
- Gogs
📦 What is this software?
Gogs by Gogs
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or compromise user accounts through stored XSS payloads.
Likely Case
Attackers with repository access could inject malicious scripts that execute when other users interact with milestones, potentially stealing credentials or performing unauthorized actions.
If Mitigated
With proper input validation and output encoding, the risk is limited to authenticated users with repository access, reducing the attack surface.
🎯 Exploit Status
Exploitation requires authenticated access to create/modify milestones. The vulnerability is straightforward to exploit once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.14.2
Vendor Advisory: https://github.com/gogs/gogs/security/advisories/GHSA-vgjm-2cpf-4g7c
Restart Required: Yes
Instructions:
1. Backup your Gogs data and configuration. 2. Download Gogs v0.14.2 or later from https://github.com/gogs/gogs/releases. 3. Stop the Gogs service. 4. Replace the existing Gogs binary with the new version. 5. Restart the Gogs service. 6. Verify the version shows 0.14.2 or higher.
🔧 Temporary Workarounds
Disable milestone creation
allRestrict milestone creation/modification permissions to trusted administrators only
Content Security Policy
allImplement strict CSP headers to mitigate XSS impact
🧯 If You Can't Patch
- Restrict milestone creation to trusted administrators only
- Implement web application firewall rules to detect and block XSS payloads
🔍 How to Verify
Check if Vulnerable:
Check if your Gogs version is below 0.14.2 by visiting the admin panel or checking the binary versionCheck Version:
./gogs --version or check Admin DashboardVerify Fix Applied:
After upgrading, verify the version shows 0.14.2 or higher and test milestone creation with HTML payloads to ensure proper sanitization📡 Detection & Monitoring
Log Indicators:
- Unusual milestone creation/modification patterns
- HTML/JavaScript content in milestone names
Network Indicators:
- Suspicious JavaScript execution in milestone-related requests
SIEM Query:
source="gogs" AND (milestone CONTAINS "<script>" OR milestone CONTAINS "javascript:")