CVE-2026-26195: Gogs: Stored XSS in branch and wiki views through author and committer names
Summary
Stored XSS is still possible through unsafe template rendering that mixes user input with safe() plus permissive sanitizer handling of data URLs.
Details
safe() still turns off escaping: - internal/template/template.go - func safe(raw string) template.HTML { return template.HTML(raw) }
Branch pages still render committer names using safe(): - templates/repo/branches/overview.tmpl - templates/repo/branches/all.tmpl - templates/repo/wiki/view.tmpl
The locale still injects a raw second argument: conf/locale/localeen-US.ini (branches.updatedby = updated %[1]s by %[2]s)
Impact
An attacker who can inject commit metadata such as author/committer name can trigger script execution on affected pages, leading to session abuse, CSRF token theft, or unauthorized actions.
Recommended Fix
- Untrusted arguments should be escaped before being used in translations. - Data URLs should be limited or blocked in the sanitizer.
Remediation A fix is available at https://github.com/gogs/gogs/releases/tag/v0.14.2.
Other sources
Gogs is an open source self-hosted Git service. Prior to version 0.14.2, stored xss is still possible through unsafe template rendering that mixes user input with safe plus permissive sanitizer handling of data urls. This issue has been patched in version 0.14.2.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26195?
CVE-2026-26195 is classified as a high severity vulnerability due to the potential for stored XSS attacks.
How do I fix CVE-2026-26195?
To fix CVE-2026-26195, update Gogs to version 0.14.2 or higher to ensure proper handling of user input.
What software versions are affected by CVE-2026-26195?
CVE-2026-26195 affects Gogs versions up to 0.14.2 and specific earlier versions up to 0.13.3.
What is the main issue with CVE-2026-26195?
The main issue with CVE-2026-26195 is stored XSS due to unsafe template rendering that fails to escape user input properly.
Can CVE-2026-26195 be exploited remotely?
Yes, CVE-2026-26195 can be exploited remotely, allowing attackers to execute malicious scripts in the context of a user’s session.