GHSA-xh32-cx6c-cp4v

Source

https://github.com/advisories/GHSA-xh32-cx6c-cp4v

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-xh32-cx6c-cp4v/GHSA-xh32-cx6c-cp4v.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xh32-cx6c-cp4v

Aliases

Published

2025-06-26T16:54:01Z

Modified

2026-09-10T03:50:25Z

Severity

6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N CVSS Calculator

Summary

Gogs XSS allowed by stored call in PDF renderer

Details

Summary

A stored XSS is present in Gogs which allows client-side Javascript code execution.

Details

Gogs Version:

docker images
REPOSITORY   TAG       IMAGE ID       CREATED        SIZE
gogs/gogs    latest    fe92583bc4fe   10 hours ago   99.3MB

Application version: 0.14.0+dev

Local setup using:

# Pull image from Docker Hub.
docker pull gogs/gogs

# Create local directory for volume.
sudo mkdir -p /var/gogs

# Use `docker run` for the first time.
docker run --name=gogs -p 10022:22 -p 10880:3000 -v /var/gogs:/data gogs/gogs

The vulnerability is caused by the usage of a vulnerable and outdated component: pdfjs-1.4.20 under public/plugins/.
Read more about this vulnerability at codeanlabs - CVE-2024-4367.

PoC

Upload the Proof of Concept file hosted at https://codeanlabs.com/wp-content/uploads/2024/05/poc_generalized_CVE-2024-4367.pdf in a repository.
Click on the file to be previewed.

poc

Credits

Edoardo Ottavianelli

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-06-26T16:54:01Z",
    "nvd_published_at":  "2025-06-24T04:15:46Z",
    "severity":  "MODERATE"
}

References

Affected packages

Go / github.com/gogs/gogs

Package

Name: github.com/gogs/gogs; View open source insights on deps.dev
Purl: pkg:golang/github.com/gogs/gogs

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.13.3-0.20250608224432-110117b2e5e5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-xh32-cx6c-cp4v/GHSA-xh32-cx6c-cp4v.json"

Go / gogs.io/gogs

Package

Name: gogs.io/gogs; View open source insights on deps.dev
Purl: pkg:golang/gogs.io/gogs

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.13.3-0.20250608224432-110117b2e5e5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-xh32-cx6c-cp4v/GHSA-xh32-cx6c-cp4v.json"