Listen to this Post
CVE-2026-26195 is a medium-severity stored Cross-Site Scripting (XSS) vulnerability affecting Gogs, a self-hosted Git service, prior to version 0.14.2 . The issue stems from unsafe template rendering where user-controlled input is mixed with trusted templates. Compounding this, the sanitizer permissively handles data URIs, allowing an attacker to inject a malicious JavaScript payload. When a victim views the compromised content, the browser executes the script, potentially leading to session hijacking or unauthorized actions. The vulnerability is network-based, requires low attack complexity, and needs no privileges or user interaction for the initial injection, though victim interaction is required for payload execution. It has been patched in Gogs version 0.14.2 .
Platform: Gogs
Version: < 0.14.2
Vulnerability: Stored XSS
Severity: MEDIUM
Date: 2026-03-05
Prediction: Already patched
What Undercode Say:
Analytics:
The vulnerability is caused by a combination of two factors. First, the template engine insecurely renders user-supplied data. Second, the HTML sanitizer fails to neutralize malicious data URIs (e.g., data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=). An attacker can store a payload in a field like an issue comment. When another user visits the page, the unsafe rendering combines the user input with the template, and the permissive sanitizer allows the `data:` URI to load, executing the script.
Exploit:
A Proof of Concept involves injecting a data URI payload into a comment field.
Example payload to be submitted via the Gogs web interface PAYLOAD="<a href=\"data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=\">Click me</a>" An attacker would post this as an issue comment or description.
When a user clicks the link or, depending on the injection point, when the page auto-loads the resource, the base64-encoded JavaScript (alert('XSS')) executes.
Protection from this CVE:
- Immediate Patching: Upgrade to Gogs version 0.14.2 or later immediately .
- Sanitizer Hardening: As a temporary measure if patching is delayed, review and harden the HTML sanitizer configuration to explicitly block `data:` URIs in all user-supplied contexts.
- Input Validation: Implement strict server-side validation and output encoding for all user inputs, especially those rendered in HTML attributes or as part of templates.
Impact:
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim’s browser session. This can lead to session hijacking, theft of sensitive information (like private repository contents or API tokens), and performing unauthorized actions on behalf of the victim, such as modifying code or creating backdoors.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow DailyCVE & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin
Gogs, Stored Cross-Site Scripting (XSS), CVE-2026-26022 (High)