GHSA-3c22-5j5m-4jq7

Source

https://github.com/advisories/GHSA-3c22-5j5m-4jq7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-3c22-5j5m-4jq7/GHSA-3c22-5j5m-4jq7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-3c22-5j5m-4jq7

Aliases

Published

2026-03-05T18:40:05Z

Modified

2026-03-23T04:55:59Z

Severity

8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N CVSS Calculator

Summary

Gokapi has Stored XSS in SVG Hotlinks

Details

Summary

If a malicious authenticated user uploads SVG and creates a hotlink for it, they achieve stored XSS.

Details

The hotlinking functionality fails to properly handle scripts included in the SVGs, allowing authenticated attackers with the ability to upload and hotlink file to execute arbitrary JS.

Issue found by aisafe.io

Impact

Authenticated attackers with the ability to upload and hotlink files can execute arbitrary JavaScript.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-05T18:40:05Z",
    "nvd_published_at":  "2026-03-06T05:16:38Z",
    "severity":  "HIGH"
}

References

Affected packages

Go / github.com/forceu/gokapi

Package

Name: github.com/forceu/gokapi; View open source insights on deps.dev
Purl: pkg:golang/github.com/forceu/gokapi

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.2.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-3c22-5j5m-4jq7/GHSA-3c22-5j5m-4jq7.json"