CVE-2021-28378: Cross-site Scripting in Gitea
Summary
CVE-2021-28378: Cross-site Scripting in Gitea. Affects code.gitea.io/gitea versions < 1.13.4. Fixed in 1.13.4. How to fix ↓
Also tracked for
- gitea · Bitnami
The same CVE-2021-28378 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gitea is an open-source self-hosted Git service written in Go. It provides a lightweight interface for managing repositories, issues, and pull requests. Gitea is widely used by individuals and organizations to host their Git repositories and collaborate on software development projects. However, Gitea versions 1.12.x and 1.13.x before 1.13.4 are vulnerable to a cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability (CVE-2021-28378) in Gitea allows an attacker to execute malicious scripts in a victim's browser. This can occur when certain issue data is not properly sanitized and is displayed in specific situations. An attacker can exploit this vulnerability by injecting malicious code into an issue, which will be executed when the issue is viewed by a user. The impact of this vulnerability can range from stealing sensitive information, such as session cookies, to performing actions on behalf of the victim within the Gitea application.
How To Fix
Latest published version: v1.26.4 as of 22 Oct 2026
go get code.gitea.io/gitea@v1.26.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.13.4
This is the first release that contains the fix.
go get code.gitea.io/gitea@v1.13.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the rendering of issue data that may contain user-generated content. This can be achieved by modifying the Gitea configuration to disable the rendering of Markdown or other formatting options in issue descriptions and comments. However, this workaround may impact the usability of the application and should only be considered as a temporary measure until the upgrade can be performed.
Conclusion
In conclusion, Gitea versions 1.12.x and 1.13.x before 1.13.4 are vulnerable to a cross-site scripting (XSS) attack. This vulnerability allows an attacker to execute malicious scripts in a victim's browser, potentially leading to the theft of sensitive information or unauthorized actions within the Gitea application. To mitigate this risk, it is recommended to upgrade Gitea to version 1.13.4 or later. If immediate upgrading is not feasible, a temporary workaround is available by disabling the rendering of user-generated content in issue descriptions and comments. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for code.gitea.io/gitea →
FAQ
The vulnerability allows an attacker to execute arbitrary scripts in a victim's browser, potentially leading to the theft of sensitive information or unauthorized actions within the Gitea application.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Gitea installation is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including CVE-2021-28378.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is important to apply the recommended fix or workaround to mitigate the risk of potential attacks.
Yes, you can temporarily mitigate the risk by disabling the rendering of user-generated content in issue descriptions and comments. However, upgrading to the latest version of Gitea is the recommended long-term solution.
For further support and assistance with vulnerability remediation, you can reach out to info@devnack.com. Our team of experts will be happy to assist you in securing your Gitea installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for code.gitea.io/gitea.
