Gitea CVE-2025-68942

Requires an authenticated Gitea user (PR:L) with access to a repository's branch/tag creation UI, running a vulnerable instance (before 1.22.2); the attacker supplies a malicious search term that is rendered via v-html in the RepoBranchTagSelector.vue 'create tag'/'create branch' hint. Exploitation is LIMITED by three factors: valid authentication is needed, a victim must view/interact with the reflected prompt (UI:R), and only instances older than 1.22.2 are affected - patched or newer deployments are not vulnerable.

This is a genuine but moderate-severity stored/DOM XSS (CWE-79), best characterized as a real-but-not-urgent issue rather than a top priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4 Medium) tells a consistent story: network-reachable, low complexity, but requiring an authenticated account (PR:L) AND victim interaction (UI:R), with only Low confidentiality/integrity impact. The scope change (S:C) is justified because injected script executes in another user's browser context. All exploitation signals point the same direction with no contradictions: EPSS is low at 0.25% (15th percentile), the CVE is NOT in CISA KEV, and there is no public exploit code - only the vendor patch diff is available, which is not an attack POC. The low EPSS is fully consistent with the unexploited, interaction-and-authentication-gated nature of the flaw. Net: a legitimate vulnerability worth patching in normal cycles, but the authentication requirement, mandatory user interaction, and absence of any exploitation evidence place it well below critical-priority emergencies.

An authenticated user with repository access enters a crafted search term containing an HTML/script payload into the branch/tag creation search box; because the 'create tag/branch' hint is rendered with v-html instead of v-text, the payload is injected into the DOM unsanitized. When the term is reflected in the rendered prompt, the attacker's script executes in the browser session, enabling session-context actions. No public exploit code exists, though the vendor patch diff clearly discloses the vulnerable sink.