Gitea CVE-2025-68946

Exploitation requires an attacker who can submit user-controlled markdown that Gitea renders - e.g. issues, comments, pull request descriptions, wiki pages, or repository files - which in a typical configuration means an authenticated low-privilege account (consistent with PR:L); the attacker embeds a link whose URL uses a forbidden scheme (javascript:, and by extension vbscript:/data: per the fix). The flaw stems from Gitea's HTML sanitizer (bluemonday v1.0.24) not blocking these dangerous link schemes before version 1.20.1. Exploitation is LIMITED by required victim interaction (the target must click the malicious link, per UI:R) and by the need to post content a victim will view; it affects Gitea instances before 1.20.1 regardless of special configuration, so no non-default setting is required.

This is a moderate, not urgent, priority. The signals are internally consistent and point toward a limited-impact stored/reflected XSS rather than a widespread threat. CVSS 3.1 is 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - network-reachable and low-complexity, but it requires an authenticated low-privilege account (PR:L) to inject the malicious markdown AND a victim to interact (UI:R) by clicking the crafted link, which substantially raises the real-world bar. EPSS is low at 0.25% (15th percentile), indicating a low modeled probability of exploitation in the near term, and the CVE is NOT listed in CISA KEV, so there is no confirmed active exploitation. There is no public exploit identified at time of analysis - the GitHub PR #25960 in the input is the vendor FIX (bumping bluemonday to v1.0.25 and explicitly blocking javascript:, vbscript:, and data: schemes), not weaponized exploit code, and should not be conflated with a POC. All signals align (medium severity, low EPSS, no KEV, no POC), so this is best treated as a routine patch-when-convenient item rather than an emergency. No SSVC decision data was provided in the input.

An attacker with a low-privilege Gitea account (before 1.20.1) posts markdown content - for example in an issue, comment, pull request, or wiki/README - containing a link whose URL uses the javascript: scheme. When another user clicks that link in their browser, the script executes in the context of their authenticated Gitea session, enabling session/credential theft or actions on their behalf. No public exploit code was identified at time of analysis, and successful exploitation depends on the victim clicking the crafted link (UI:R).