CVE-2022-31038: Cross-site Scripting vulnerability in Gogs
Summary
CVE-2022-31038: Cross-site Scripting vulnerability in repository issue list in Gogs. Affects gogs.io/gogs versions < 0.12.9. Fixed in 0.12.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gogs is an open-source self-hosted Git service written in Go. It provides a lightweight and efficient way to manage repositories, issues, and pull requests. Gogs allows users to create and manage repositories, collaborate with others, and track issues and bugs. However, a vulnerability has been discovered in the repository issue list feature of Gogs, which could lead to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2022-31038, arises from the DisplayName field in the issue list, which allows all characters from users. This lack of input sanitization makes it possible for malicious users to inject arbitrary scripts into the issue list, leading to potential XSS attacks. The impact of this vulnerability can range from unauthorized access to sensitive information to the execution of malicious code on the affected user's browser.
How To Fix
Latest published version: v0.13.3 as of 22 Oct 2026
go get gogs.io/gogs@v0.13.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.12.9
This is the first release that contains the fix.
go get gogs.io/gogs@v0.12.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the patched version is not immediately feasible, users can manually check and update the display names of existing users that may contain malicious characters. By ensuring that display names are properly sanitized, the risk of XSS attacks can be reduced. However, this workaround is not a permanent solution and should be followed by upgrading to the latest version of Gogs as soon as possible.
Conclusion
In conclusion, the vulnerability in Gogs' repository issue list feature exposes users to potential cross-site scripting (XSS) attacks. To mitigate this risk, users should upgrade to the patched version of Gogs (0.12.9 or 0.13.0+dev) and ensure that display names are properly sanitized. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gogs.io/gogs →
FAQ
Gogs is an open-source self-hosted Git service written in Go. It provides a lightweight and efficient way to manage repositories, issues, and pull requests.
The vulnerability allows for potential cross-site scripting (XSS) attacks, which can lead to unauthorized access to sensitive information or the execution of malicious code on the affected user's browser.
To fix this vulnerability, users should upgrade to Gogs version 0.12.9 or the latest 0.13.0+dev, which includes a patch for the XSS vulnerability in the issue list.
If immediate upgrading is not possible, users can manually check and update the display names of existing users that may contain malicious characters. However, this is not a permanent solution, and upgrading to the latest version is strongly recommended.
For more information, you can visit the GitHub pull request at https://github.com/gogs/gogs/pull/7009.
References
Related vulnerabilities
Recent vulnerabilities recorded for gogs.io/gogs.
