CVE-2025-68942: 
NixOS vulnerability analysis and mitigation

CVE-2025-68942 is a stored Cross-Site Scripting (XSS) vulnerability in Gitea affecting all versions before 1.22.2. The flaw exists in the search input box used for creating tags and branches, where the Vue.js directive v-html is used instead of the safer v-text, allowing user-supplied HTML to be rendered in the browser. It was published on December 25–26, 2025, and carries a CVSS v3.1 base score of 5.4 (Medium) (Github Advisory, Red Hat).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the use of Vue.js's v-html directive in the search input component responsible for tag and branch creation. Unlike v-text, which renders content as plain text, v-html interprets and renders raw HTML, allowing an authenticated attacker to inject arbitrary HTML/JavaScript payloads into the input field. The fix, implemented in pull request #31966, replaces v-html with v-text in the affected component, preventing HTML interpretation of user-supplied input (Gitea PR #31966, Github Advisory).

Successful exploitation allows an authenticated low-privileged attacker to execute arbitrary JavaScript in the browsers of other users who interact with the affected search input. This can result in session cookie theft, credential harvesting, unauthorized actions performed on behalf of victims, and targeted social engineering via injected malicious content. Availability is not impacted, but both confidentiality and integrity are affected at a low level within a changed scope (Github Advisory, Red Hat).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The vulnerability requires an authenticated attacker with low privileges and victim user interaction, limiting its exploitability. The EPSS score is approximately 0.029% (0.000290), placing it in the lowest percentile for near-term exploitation likelihood. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Feedly).

1. Reconnaissance: Identify a Gitea instance running a version prior to 1.22.2 (e.g., via the Gitea version disclosure on the instance's footer or API endpoint /api/v1/version).
2. Authentication: Log in to the Gitea instance with any valid low-privileged user account.
3. Locate the vulnerable input: Navigate to a repository and open the tag or branch creation dialog, which contains the search input box rendered with v-html.
4. Inject XSS payload: Enter a crafted HTML/JavaScript payload (e.g., <img src=x onerror=alert(document.cookie)>) into the search input field for creating a tag or branch.
5. Trigger victim interaction: Induce a target user (e.g., a repository maintainer or admin) to interact with the affected component — for example, by sharing a crafted URL or through social engineering.
6. Achieve objective: When the victim's browser renders the injected payload via v-html, the attacker's JavaScript executes in the victim's browser context, enabling session hijacking, data exfiltration, or further unauthorized actions (Gitea PR #31966, Github Advisory).

• Logs: Gitea access logs showing requests to tag/branch creation endpoints containing HTML tags or JavaScript patterns (e.g., <script>, onerror=, javascript:) in query or body parameters.
• Network: Unexpected outbound HTTP requests from victim browsers to attacker-controlled domains following interaction with Gitea tag/branch search inputs; unusual POST requests to Gitea endpoints with encoded HTML payloads.
• Application Behavior: Unexpected JavaScript alerts, redirects, or network requests originating from the Gitea web UI during tag or branch creation workflows.

The primary remediation is to upgrade Gitea to version 1.22.2 or later, which replaces the vulnerable v-html directive with v-text in the affected search input component (Gitea Release v1.22.2, Gitea Blog). As interim mitigations, administrators can deploy a Web Application Firewall (WAF) with XSS detection rules targeting tag/branch creation endpoints, and enforce strict Content Security Policy (CSP) headers to limit script execution. Restricting user registration and applying least-privilege access controls can further reduce the attack surface.

Red Hat tracked the vulnerability via Bugzilla (Bug 2425464) and assigned it a medium severity rating, reflecting its limited exploitability due to authentication and user interaction requirements (Red Hat Bugzilla). The GitHub Advisory Database published the advisory (GHSA-898p-hh3p-hf9r) on December 26, 2025, with a moderate severity classification (Github Advisory). No significant broader media coverage or notable researcher commentary has been identified beyond standard vulnerability database entries.