Cross-Site Scripting via Cookies in gogs.io/gogs
Summary
GO-2022-0473: Cross site scripting via cookies in gogs in gogs.io/gogs. Affects gogs.io/gogs versions < 0.12.8. Fixed in 0.12.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The gogs.io/gogs package is an open-source self-hosted Git service written in Go. It provides a lightweight and efficient way to manage repositories, users, and organizations. This vulnerability affects versions prior to 0.12.8.
Vulnerability Detail
This vulnerability allows for cross-site scripting (XSS) attacks via cookies in gogs.io/gogs. An attacker can inject malicious scripts into the cookies, which are then executed by the victim's browser. This can lead to various security risks, such as session hijacking, data theft, and unauthorized actions on behalf of the victim.
How To Fix
Latest published version: v0.13.3 as of 22 Oct 2026
go get gogs.io/gogs@v0.13.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.12.8
This is the first release that contains the fix.
go get gogs.io/gogs@v0.12.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is crucial to update to the latest version of gogs.io/gogs to ensure the security of your application.
Conclusion
The cross-site scripting vulnerability in gogs.io/gogs can lead to serious security risks, including session hijacking and data theft. It is crucial to update to version 0.12.8 or later to mitigate this vulnerability.
See every vulnerability recorded for gogs.io/gogs →
FAQ
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as session hijacking, data theft, and defacement of websites.
An attacker can exploit this vulnerability by injecting malicious scripts into the cookies of gogs.io/gogs. When a victim accesses the affected application, their browser executes these scripts, allowing the attacker to perform unauthorized actions on behalf of the victim.
No, only versions prior to 0.12.8 are affected by this vulnerability. It is recommended to upgrade to the latest version to ensure the security of your application.
Currently, there is no known workaround for this vulnerability. It is crucial to update to the latest version of gogs.io/gogs to mitigate the risk.
You can find more information about this vulnerability in the Open Source Vulnerability database at https://pkg.go.dev/vuln/GO-2022-0473.
References
Related vulnerabilities
Recent vulnerabilities recorded for gogs.io/gogs.
