What is the CVSS score of CVE-2026-26022?

CVE-2026-26022 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Gogs are affected by CVE-2026-26022?

A stored cross-site scripting (XSS) vulnerability in Gogs version prior to 0.14.2 allows attackers to inject malicious code through issue descriptions and comments that executes when other users view…. A patch is available.

Is there a public PoC exploit available for CVE-2026-26022?

Yes, a public proof-of-concept exploit is available for CVE-2026-26022. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-26022?

Within 24 hours: Inventory all Gogs instances in your environment and confirm versions below 0.14.2. Within 7 days: Apply the available patch to upgrade Gogs to version 0.14.2 or later across all instances; prioritize production and internet-facing systems first. Within 30 days: Conduct a security audit of all repositories and issues created prior to patching to identify any malicious content injections; review access logs for suspicious activity.

Gogs CVE-2026-26022

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-05 security-advisories@github.com

GHSA-xrcr-gmf5-2r8j

XSS Gogs Suse

8.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

PoC Detected

Mar 06, 2026 - 13:55 vuln.today

Public exploit code

Patch released

Mar 06, 2026 - 13:55 nvd

Patch available

CVE Published

Mar 05, 2026 - 19:16 nvd

HIGH 8.7

DescriptionGitHub Advisory

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, a stored cross-site scripting (XSS) vulnerability exists in the comment and issue description functionality. The application's HTML sanitizer explicitly allows data: URI schemes, enabling authenticated users to inject arbitrary JavaScript execution via malicious links. This issue has been patched in version 0.14.2.

AnalysisAI

Stored XSS in Gogs prior to version 0.14.2 allows authenticated users to execute arbitrary JavaScript in comments and issue descriptions by exploiting the HTML sanitizer's allowance of data: URI schemes. This affects all users viewing malicious content within the same Gogs instance and could enable session hijacking or credential theft. Public exploit code exists for this vulnerability, though a patch is available in version 0.14.2 and later.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects the comment and issue description component of Gogs. Gogs is an open source self-hosted Git service. Prior to version 0.14.2, a stored cross-site scripting (XSS) vulnerability exists in the comment and issue description functionality. The application's HTML sanitizer explicitly allows data: URI schemes, enabling authenticated users to inject arbitrary JavaScript execution via malicious links. This issue has been patched in version 0.14.2.

RemediationAI

A vendor patch is available — apply it immediately. Fixed in version 0.14.2.. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.