GHSA-vgvf-m4fw-938j

Suggest an improvement
Source
https://github.com/advisories/GHSA-vgvf-m4fw-938j
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-vgvf-m4fw-938j/GHSA-vgvf-m4fw-938j.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-vgvf-m4fw-938j
Aliases
Published
2026-03-05T19:48:33Z
Modified
2026-03-23T04:56:07Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Gogs: Stored XSS in branch and wiki views through author and committer names
Details

Summary

Stored XSS is still possible through unsafe template rendering that mixes user input with safe() plus permissive sanitizer handling of data URLs.

Details

safe() still turns off escaping:

  • internal/template/template.go
  • func safe(raw string) template.HTML { return template.HTML(raw) }

Branch pages still render committer names using safe():

  • templates/repo/branches/overview.tmpl
  • templates/repo/branches/all.tmpl
  • templates/repo/wiki/view.tmpl

The locale still injects a raw second argument: conf/locale/locale_en-US.ini (branches.updated_by = updated %[1]s by %[2]s)

Impact

An attacker who can inject commit metadata such as author/committer name can trigger script execution on affected pages, leading to session abuse, CSRF token theft, or unauthorized actions.

Recommended Fix

  • Untrusted arguments should be escaped before being used in translations.
  • Data URLs should be limited or blocked in the sanitizer.

Remediation

A fix is available at https://github.com/gogs/gogs/releases/tag/v0.14.2.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-05T19:48:33Z",
    "nvd_published_at": "2026-03-05T19:16:03Z",
    "severity": "MODERATE"
}
References

Affected packages

Go / gogs.io/gogs

Package

Name
gogs.io/gogs
View open source insights on deps.dev
Purl
pkg:golang/gogs.io/gogs

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
0.13.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-vgvf-m4fw-938j/GHSA-vgvf-m4fw-938j.json"