Gogs: Stored XSS in branch and wiki views through author and committer names

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS 4.0

6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N · score source

EPSS

• CVE-2026-26195: 0.22% estimated exploitation activity in the next 30 days; percentile 13.29 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary Stored XSS is still possible through unsafe template rendering that mixes user input with safe() plus permissive sanitizer handling of data URLs. Details safe() still turns off escaping: - internal/template/template.go - func safe(raw string) template.HTML { return template.HTML(raw) } Branch pages still render committer names using safe(): - templates/repo/branches/overview.tmpl - templates/repo/branches/all.tmpl - templates/repo/wiki/view.tmpl The locale still injects a raw second argument: conf/locale/localeen-US.ini (branches.updatedby = updated %[1]s by %[2]s) Impact An attacker who can inject commit metadata such as author/committer name can trigger script execution on affected pages, leading to session abuse, CSRF token theft, or unauthorized actions. Recommended Fix - Untrusted arguments should be escaped before being used in translations. - Data URLs should be limited or blocked in the sanitizer. Remediation A fix is available at…

Published by the source

5 Mar 2026, 19:48 UTC

Last modified by the source

5 Mar 2026, 22:28 UTC

Source last checked

26 Oct 2026, 15:15 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-vgvf-m4fw-938j

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-26195

Advisory: Gogs: Stored XSS in branch and wiki views through author and committer names
IDs: CVE-2026-26195, GHSA-vgvf-m4fw-938j
Record: https://patchnext.com/advisories/cve-2026-26195 (revision 1, source checked 26 Oct 2026, 15:15 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 6.9)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor response not established. A vendor fix does not mean a deployment is fixed.

## Affected components
- Go gogs.io/gogs: affected <= 0.13.3

## Suggested inspection (read-only)
- Go gogs.io/gogs: check the installed version with your package manager.

## Supported action
No complete vendor fix is recorded. Follow the primary source's mitigation guidance and check this record again before closing anything.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on gogs.io/gogs.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-vgvf-m4fw-938j (GitHub-reviewed advisory GHSA-vgvf-m4fw-938j lists affected ranges: Go gogs.io/gogs >=0 <=0.13.3)

Commands are suggestions: review each one before running it.