CVE-2026-26022

A Stored Cross-site Scripting (XSS) vulnerability exists in the comment and issue description functionality. The application's HTML sanitizer explicitly allows data: URI schemes, enabling authenticated users to inject arbitrary JavaScript execution via malicious links.

Details

The vulnerability is located in internal/markup/sanitizer.go. The application uses the bluemonday HTML sanitizer but explicitly weakens the security policy by allowing the data URL scheme:

// internal/markup/sanitizer.go
func NewSanitizer() {
    sanitizer.init.Do(func() {
        // ...
        // Data URLs
        sanitizer.policy.AllowURLSchemes("data")
        // ...
    })
}

While the Markdown renderer rewrites relative links (mitigating standard Markdown [link](data:...) attacks), Gogs supports Raw HTML input. Raw HTML anchor tags bypass the Markdown parser's link rewriting and are processed directly by the sanitizer. Since the sanitizer is configured to allow data: URIs, payloads like <a href="data:text/html..."> are rendered as-is.

PoC

1. Create a file named exploit.md in a repository.
2. Add the following content (Raw HTML):

   <a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=">Click me for XSS</a>
   

3. Commit and push the file.
4. Navigate to the file in the Gogs web interface.
5. Click the "Click me for XSS" link.
6. Result: An alert box with "XSS" appears, executing the JavaScript payload.

This is a Stored XSS vulnerability. Any user who views the malicious comment and clicks the link will execute the attacker-supplied JavaScript in their browser context. This allows attackers to:

• Steal authentication cookies and session tokens.
• Perform arbitrary actions on behalf of the victim (e.g., modifying repositories, adding collaborators).
• Redirect users to malicious sites.

Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.

CVE-2026-26022 has a CVSS score of 8.7 (High). The vector is network-reachable, low privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.14.2); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2026-26022? CVE-2026-26022 is a high-severity cross-site scripting (XSS) vulnerability in gogs.io/gogs (go), affecting versions <= 0.14.1. It is fixed in 0.14.2. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
2. How severe is CVE-2026-26022? CVE-2026-26022 has a CVSS score of 8.7 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of gogs.io/gogs are affected by CVE-2026-26022? gogs.io/gogs (go) versions <= 0.14.1 is affected.
4. Is there a fix for CVE-2026-26022? Yes. CVE-2026-26022 is fixed in 0.14.2. Upgrade to this version or later.
5. Is CVE-2026-26022 exploitable, and should I be worried? Whether CVE-2026-26022 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-26022 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-26022? Upgrade gogs.io/gogs to 0.14.2 or later.