CVE-2026-26022
Published: 05 March 2026
Summary
CVE-2026-26022 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Gogs Gogs. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 3.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-15 (Information Output Filtering) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 requires timely flaw remediation, directly addressing the specific HTML sanitizer vulnerability in Gogs by applying the patch in version 0.14.2.
SI-15 mandates output filtering to prevent XSS by sanitizing rendered content like comments and issue descriptions, blocking malicious data: URI schemes.
SI-10 enforces input validation at entry points to restrict malicious payloads such as data: URIs in comment and issue submissions.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS directly enables browser session hijacking (T1185) via malicious JS, stealing web session cookies (T1539), external defacement of repo content (T1491.002), and use of stolen cookies for actions as victim (T1550.004).
NVD Description
Gogs is an open source self-hosted Git service. Prior to version 0.14.2, a stored cross-site scripting (XSS) vulnerability exists in the comment and issue description functionality. The application's HTML sanitizer explicitly allows data: URI schemes, enabling authenticated users to inject…
more
arbitrary JavaScript execution via malicious links. This issue has been patched in version 0.14.2.
Deeper analysisAI
CVE-2026-26022 is a stored cross-site scripting (XSS) vulnerability (CWE-79) in Gogs, an open source self-hosted Git service. The flaw affects versions prior to 0.14.2 and resides in the comment and issue description functionality, where the HTML sanitizer explicitly permits data: URI schemes. This allows authenticated users to inject malicious links that enable arbitrary JavaScript execution when rendered in users' browsers.
An authenticated attacker with low privileges can exploit this vulnerability over the network with low complexity, though it requires user interaction from a victim viewing the tainted comment or issue. Successful exploitation leads to high confidentiality and integrity impacts with a changed scope, potentially allowing attackers to steal session cookies, perform actions on behalf of victims, or deface repository content. The CVSS v3.1 base score is 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
The issue has been addressed in Gogs version 0.14.2, as detailed in the project's security advisory (GHSA-xrcr-gmf5-2r8j), release notes, associated pull request (#8174), and patching commit (441c64d7bd8893b2f4e48660a8be3a7472e14291). Security practitioners should urge users to upgrade immediately to mitigate the risk.
Details
- CWE(s)