CVE-2026-26276
Published: 05 March 2026
Summary
CVE-2026-26276 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Gogs Gogs. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-26276 is a DOM-based cross-site scripting (XSS) vulnerability, classified under CWE-79, affecting Gogs, an open source self-hosted Git service. In versions prior to 0.14.2, the flaw allows an attacker to store an HTML/JavaScript payload in a repository's Milestone name. This payload is then triggered as a DOM-based XSS when another user selects that Milestone on the New Issue page (/issues/new). The vulnerability carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N), indicating high confidentiality and integrity impacts with no availability disruption.
An attacker requires low privileges, such as repository write access to create or modify a Milestone with a malicious payload. Exploitation occurs over the network with low complexity but demands user interaction, specifically a victim navigating to the New Issue page and selecting the tainted Milestone. Successful exploitation enables the payload to execute in the victim's browser context, potentially leading to session hijacking, data theft, or further phishing attacks against the targeted user.
The issue has been addressed in Gogs version 0.14.2, as detailed in the official release notes, a corresponding pull request, and the project's security advisory. Security practitioners should upgrade to version 0.14.2 or later to mitigate the vulnerability, with no additional workarounds specified in the provided references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9855
Vulnerability details
Gogs is an open source self-hosted Git service. Prior to version 0.14.2, an attacker can store an HTML/JavaScript payload in a repository’s Milestone name, and when another user selects that Milestone on the New Issue page (/issues/new), a DOM-Based XSS…
more
is triggered. This issue has been patched in version 0.14.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored/DOM-based XSS in public-facing Gogs web app enables injection of malicious JS payload that executes in victim browsers upon normal page interaction (New Issue + Milestone selection), directly mapping to exploitation of the application and drive-by compromise of users.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all inputs (Milestone names) to reject or sanitize HTML/JS payloads before storage and subsequent DOM use on /issues/new.
Requires filtering of untrusted data on output so that stored Milestone content cannot execute scripts in the victim's browser context.
Can block or detect malicious script insertion at system boundaries, providing secondary protection against the stored XSS payload.