CVE-2026-26276
Published: 05 March 2026
Summary
CVE-2026-26276 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Gogs Gogs. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored/DOM-based XSS in public-facing Gogs web app enables injection of malicious JS payload that executes in victim browsers upon normal page interaction (New Issue + Milestone selection), directly mapping to exploitation of the application and drive-by compromise of users.
NVD Description
Gogs is an open source self-hosted Git service. Prior to version 0.14.2, an attacker can store an HTML/JavaScript payload in a repository’s Milestone name, and when another user selects that Milestone on the New Issue page (/issues/new), a DOM-Based XSS…
more
is triggered. This issue has been patched in version 0.14.2.
Deeper analysisAI
CVE-2026-26276 is a DOM-based cross-site scripting (XSS) vulnerability, classified under CWE-79, affecting Gogs, an open source self-hosted Git service. In versions prior to 0.14.2, the flaw allows an attacker to store an HTML/JavaScript payload in a repository's Milestone name. This payload is then triggered as a DOM-based XSS when another user selects that Milestone on the New Issue page (/issues/new). The vulnerability carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N), indicating high confidentiality and integrity impacts with no availability disruption.
An attacker requires low privileges, such as repository write access to create or modify a Milestone with a malicious payload. Exploitation occurs over the network with low complexity but demands user interaction, specifically a victim navigating to the New Issue page and selecting the tainted Milestone. Successful exploitation enables the payload to execute in the victim's browser context, potentially leading to session hijacking, data theft, or further phishing attacks against the targeted user.
The issue has been addressed in Gogs version 0.14.2, as detailed in the official release notes, a corresponding pull request, and the project's security advisory. Security practitioners should upgrade to version 0.14.2 or later to mitigate the vulnerability, with no additional workarounds specified in the provided references.
Details
- CWE(s)