What is the CVSS score of CVE-2026-26276?

CVE-2026-26276 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Gogs are affected by CVE-2026-26276?

Gogs instances running versions prior to 0.14.2 are vulnerable to stored cross-site scripting (XSS) attacks through maliciously crafted milestone names.

How to fix or mitigate CVE-2026-26276?

Within 24 hours: Identify all Gogs instances in your environment and document their versions. Within 7 days: Implement network access controls to limit Gogs exposure, disable public issue creation if possible, and audit existing milestones for suspicious payloads. Within 30 days: Upgrade to Gogs 0.14.2 or later once available, or migrate to an alternative Git service if upgrading is not feasible.

Gogs CVE-2026-26276

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-05 security-advisories@github.com

GHSA-vgjm-2cpf-4g7c

XSS Gogs Suse

7.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.3 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 19:16 nvd

HIGH 7.3

DescriptionGitHub Advisory

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, an attacker can store an HTML/JavaScript payload in a repository’s Milestone name, and when another user selects that Milestone on the New Issue page (/issues/new), a DOM-Based XSS is triggered. This issue has been patched in version 0.14.2.

AnalysisAI

Gogs versions prior to 0.14.2 contain a DOM-based XSS vulnerability in the Issue creation page where attackers can inject malicious scripts through milestone names that execute when other users interact with those milestones. An authenticated attacker can craft a repository with a malicious milestone name containing JavaScript payloads that trigger in victim browsers, potentially compromising user sessions or sensitive data. No patch is currently available for affected versions.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Gogs. Gogs is an open source self-hosted Git service. Prior to version 0.14.2, an attacker can store an HTML/JavaScript payload in a repository’s Milestone name, and when another user selects that Milestone on the New Issue page (/issues/new), a DOM-Based XSS is triggered. This issue has been patched in version 0.14.2.

RemediationAI

Fixed in version 0.14.2.. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.