EUVD-2026-41433
GHSA-r26p-rw8p-x468
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects non-default DEFAULT_SHOW_FULL_NAME prerequisite; PR:L for authenticated attacker; S:C and C:L/I:L for cross-user browser impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Forgejo before 15.0.3 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by setting a full name containing an HTML payload and triggering an Actions run. When the DEFAULT_SHOW_FULL_NAME option is enabled, the run description is assembled server-side with the user's display name interpolated into an HTML string via a translation function that does not escape its arguments, and the frontend renders the result using a Vue v-html binding, causing script execution for any user who views the affected Actions run page.
AnalysisAI
Stored XSS in Forgejo before 15.0.3 allows authenticated users to execute arbitrary JavaScript in other users' browsers by embedding an HTML payload in their display name and triggering a CI/CD Actions run. The vulnerability exists because the server-side run description assembles HTML by interpolating the user's full name through a translation function that performs no output encoding, and the frontend renders this server-generated markup via a Vue v-html binding - a classic sink for stored XSS. No public exploit identified at time of analysis as actively exploited in the wild, but a public proof-of-concept exists at the VulnCheck-referenced GitHub repository. The CVSS 4.0 score of 2.1 reflects the non-default configuration prerequisite and passive user interaction required, but the impact on subsequent systems (other users' browser sessions) is real.
Technical ContextAI
Forgejo is a self-hosted, community-driven git forge (CPE: cpe:2.3:a:forgejo:forgejo:*:*:*:*:*:*:*:*), originally forked from Gitea, commonly deployed by open-source communities and organizations needing on-premises source code management with CI/CD capabilities via its Actions runner. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS variant. The flaw lies at the intersection of two design choices: (1) a server-side i18n/translation function that interpolates user-controlled data (the full name field) directly into an HTML template string without escaping, and (2) the Vue.js frontend rendering that assembled string through v-html, which bypasses Vue's default cross-site scripting protections. The profile picture or display name field accepting arbitrary Unicode/HTML characters without sanitization at ingestion or at render time is the proximate technical failure. The PR fixing this (codeberg.org/forgejo/forgejo/pulls/13002) likely introduces proper HTML escaping in the translation function or switches the v-html binding to v-text.
RemediationAI
The primary fix is to upgrade to Forgejo 15.0.3 or later, as documented at https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/15.0.3.md. The upstream fix is tracked in pull request #13002 at https://codeberg.org/forgejo/forgejo/pulls/13002. If an immediate upgrade is not feasible, the most effective compensating control is to set DEFAULT_SHOW_FULL_NAME to false (or leave it at its default disabled state), which prevents the vulnerable code path from assembling the malicious HTML string into the run description. Trade-off: disabling this option means Actions run descriptions will display usernames rather than full display names, which may reduce auditability in environments that rely on full names for user identification. A secondary control is to restrict Actions runner access to trusted users only, reducing the attacker pool to accounts that can actually trigger runs. Do not rely on content-security-policy alone as a complete mitigation without patching, as CSP effectiveness depends on configuration.
Remote code execution in Forgejo before 16.0.4 allows an authenticated user who can supply a template repository to run
In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissio
Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication. Rated high severity (CVSS 7.5), t
Server-side request forgery in Forgejo up to 15.0.4 allows authenticated users to bypass the repository migration IP all
Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appending .rss (or
Identity spoofing in Forgejo's ActivityPub federation allows a remote attacker who controls any single valid ActivityPub
Restricted API token authorization bypass in Forgejo before 16.0.4 (and before 15.0.8 on the 15.x branch) allows authent
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today