CVE-2026-26276: 
Gogs 脆弱性の分析と軽減

CVE-2026-26276 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in Gogs, an open-source self-hosted Git service. An authenticated attacker can store a malicious HTML/JavaScript payload in a repository's Milestone name; when another user selects that Milestone on the New Issue page (/issues/new), the payload is executed in their browser. All Gogs versions up to and including 0.13.3 (per the GitHub Advisory Database) / prior to 0.14.2 are affected. The vulnerability was disclosed on March 5, 2026, and carries a CVSS v3.1 base score of 7.3 (High) (Github Advisory, Gogs Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically arising from the use of jQuery's .html() method with string concatenation when rendering milestone and assignee selections on the issue creation page (public/js/gogs.js). Because user-controlled Milestone name text was inserted directly into the DOM via .html(), any embedded HTML or JavaScript was interpreted and executed by the browser rather than treated as plain text. The fix replaced unsafe .html() calls with safe jQuery DOM APIs (.text(), .attr(), createTextNode) that prevent user-controlled content from being reinterpreted as HTML (Gogs PR #8178, Gogs Advisory). Exploitation requires the attacker to have repository access sufficient to create or modify Milestones, and a victim user must interact with the New Issue page and select the malicious Milestone.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can result in theft of session tokens and sensitive information accessible within the session, extraction of CSRF tokens enabling unauthorized state-changing requests (such as issue operations and settings changes), and repository operations performed with the victim's privileges. The severity of impact scales with the victim's permission level — a high-privileged victim (e.g., repository administrator) could result in full repository compromise (Github Advisory, Gogs Advisory).

1. Gain repository access: Obtain an account on the target Gogs instance with at least contributor-level access to a repository, sufficient to create or edit Milestones.
2. Create a malicious Milestone: Navigate to the repository's Milestones page and create a new Milestone with a name containing an XSS payload, e.g., <img src=x onerror=alert(document.cookie)> or a more sophisticated payload to exfiltrate session cookies or CSRF tokens.
3. Lure the victim: Social-engineer or wait for a target user (ideally with elevated privileges) to visit the New Issue page (/issues/new) of the affected repository.
4. Trigger XSS: When the victim opens the New Issue page and the milestone dropdown is rendered, the JavaScript payload embedded in the Milestone name is injected into the DOM via the unsafe .html() call and executed in the victim's browser context.
5. Harvest credentials or perform actions: The executed script can exfiltrate session cookies, extract CSRF tokens, and submit authenticated requests (e.g., changing repository settings, adding collaborators, or deleting issues) on behalf of the victim (Gogs Advisory, Gogs PR #8178).

• Logs: Web server access logs showing requests to /issues/new from users who subsequently trigger unexpected outbound connections or unusual API calls; audit logs showing repository settings changes or issue operations from accounts that did not initiate them.
• Network: Unexpected outbound HTTP/S requests from victim browsers to attacker-controlled domains shortly after visiting /issues/new (potential cookie/token exfiltration); unusual POST requests to Gogs API endpoints (e.g., /api/v1/repos/) not initiated by the account owner.
• Application: Milestone names in the repository database containing HTML tags or JavaScript event handlers (e.g., <script>, onerror=, onload=, javascript:); unexpected changes to repository settings, collaborator lists, or issue states that cannot be attributed to known user actions.

The primary remediation is to upgrade Gogs to version 0.14.2 or later, which replaces unsafe jQuery .html() DOM construction with safe alternatives (.text(), .attr(), createTextNode) for milestone and assignee rendering (Gogs Release v0.14.2, Gogs PR #8178). Note that version 0.14.3 is also available and recommended as a direct upgrade target. As interim mitigations, administrators should restrict Milestone creation and modification privileges to trusted users only, implement Content Security Policy (CSP) headers to limit the impact of any XSS, and ensure output encoding is applied to all user-supplied content rendered in the UI.

The vulnerability was reported by security researcher odgrso and patched by Gogs maintainer unknwon via PR #8178, merged on February 14, 2026, ahead of the public disclosure on March 5, 2026 (Gogs PR #8178, Github Advisory). The fix was included in the 0.14.2 release alongside several other security fixes, indicating a coordinated security release cycle. The Go vulnerability database (golang/vulndb) also tracked this issue, reflecting standard open-source ecosystem response (Gogs Release v0.14.2).