What is the CVSS score of CVE-2026-26022?

CVE-2026-26022 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Gogs are affected by CVE-2026-26022?

A stored cross-site scripting (XSS) vulnerability in Gogs version prior to 0.14.2 allows attackers to inject malicious code through issue descriptions and comments that executes when other users view…. A patch is available.

Is there a public PoC exploit available for CVE-2026-26022?

Yes, a public proof-of-concept exploit is available for CVE-2026-26022. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-26022?

Within 24 hours: Inventory all Gogs instances in your environment and confirm versions below 0.14.2. Within 7 days: Apply the available patch to upgrade Gogs to version 0.14.2 or later across all instances; prioritize production and internet-facing systems first. Within 30 days: Conduct a security audit of all repositories and issues created prior to patching to identify any malicious content injections; review access logs for suspicious activity.

Gogs CVE-2026-26022

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-05 security-advisories@github.com

GHSA-xrcr-gmf5-2r8j

XSS Gogs Suse

8.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

PoC Detected

Mar 06, 2026 - 13:55 vuln.today

Public exploit code

Patch released

Mar 06, 2026 - 13:55 nvd

Patch available

CVE Published

Mar 05, 2026 - 19:16 nvd

HIGH 8.7

DescriptionGitHub Advisory

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, a stored cross-site scripting (XSS) vulnerability exists in the comment and issue description functionality. The application's HTML sanitizer explicitly allows data: URI schemes, enabling authenticated users to inject arbitrary JavaScript execution via malicious links. This issue has been patched in version 0.14.2.

AnalysisAI

Stored XSS in Gogs prior to version 0.14.2 allows authenticated users to execute arbitrary JavaScript in comments and issue descriptions by exploiting the HTML sanitizer's allowance of data: URI schemes. This affects all users viewing malicious content within the same Gogs instance and could enable session hijacking or credential theft. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate to Gogs instance

Exploit

Create issue or comment with data: URI link

Execution

User clicks malicious link

Impact

Execute arbitrary JavaScript in browser context

Access

Authenticate to Gogs instance

Exploit

Create issue or comment with data: URI link

Execution

User clicks malicious link

Impact

Execute arbitrary JavaScript in browser context

Vulnerability AssessmentAI

Exploitation	Gogs version prior to 0.14.2 with HTML sanitizer allowing data: URI schemes. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 8.7 (HIGH). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker (requires authentication) could exploit this vulnerability to compromise the affected system.
Remediation	A vendor patch is available — apply it immediately. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Inventory all Gogs instances in your environment and confirm versions below 0.14.2. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Vendor StatusVendor

SUSE

Severity: High

CVE-2026-26022 vulnerability details – vuln.today

Back

Gogs CVE-2026-26022

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code