CVE-2026-26276: Gogs DOM-Based XSS via Milestone Selection
Summary
CVE-2026-26276: Gogs: DOM-based XSS via milestone selection. Affects gogs.io/gogs versions < 0.13.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gogs is an open-source self-hosted Git service that allows users to manage repositories, track issues, and collaborate on projects. It provides features such as pull requests, code review, and milestone tracking. However, due to a vulnerability in the milestone naming feature, Gogs is susceptible to DOM-based cross-site scripting (XSS) attacks, which can compromise user sessions and permissions.
Vulnerability Detail
The vulnerability arises from the ability of an attacker to store malicious HTML/JavaScript payloads in a repository's milestone name. When another user selects this milestone on the 'New Issue' page, the payload is executed in the user's browser, leading to a DOM-based XSS attack. This can result in the theft of sensitive information from the victim's session, extraction of CSRF tokens, and unauthorized actions performed with the victim's privileges, depending on their permission level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using milestone names that contain HTML or JavaScript content. Educate users to be cautious about selecting milestones from untrusted sources until the software is updated.
Conclusion
The CVE-2026-26276 vulnerability in Gogs poses a significant risk due to its potential for DOM-based XSS attacks. Users are advised to update to the latest version to safeguard their applications and data. Awareness and caution regarding milestone names can help mitigate risks until updates are applied.
See every vulnerability recorded for gogs.io/gogs →
FAQ
DOM-based XSS is a type of cross-site scripting attack where the payload is executed in the Document Object Model (DOM) of the browser, rather than being sent to the server.
If exploited, this vulnerability can allow attackers to steal session information, perform unauthorized actions, and compromise the security of your repositories.
Yes, a patch is available in Gogs version 0.14.2 and later. It is recommended to update to this version to mitigate the risk.
If you cannot update immediately, avoid using milestone names with potentially malicious content and educate users about the risks.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for gogs.io/gogs.
