CVE-2026-26276: Gogs: DOM-based XSS via milestone selection
Summary
It was confirmed in a test environment that an attacker can store an HTML/JavaScript payload in a repository’s Milestone name, and when another user selects that Milestone on the New Issue page (/issues/new), a DOM-Based XSS is triggered.
Impact
Theft of information accessible in the victim’s session. Extraction of CSRF tokens and submission of state-changing requests with the victim’s privileges. Repository operations performed with the victim’s privileges (Issue operations, settings changes, etc.).
(The impact scope depends on the victim’s permission level.)
Remediation
A fix is available at https://github.com/gogs/gogs/releases/tag/v0.14.2
Other sources
Gogs is an open source self-hosted Git service. Prior to version 0.14.2, an attacker can store an HTML/JavaScript payload in a repository’s Milestone name, and when another user selects that Milestone on the New Issue page (/issues/new), a DOM-Based XSS is triggered. This issue has been patched in version 0.14.2.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26276?
CVE-2026-26276 has a medium severity rating due to the potential for DOM-based XSS attacks.
How do I fix CVE-2026-26276?
To fix CVE-2026-26276, update Gogs to version 0.14.2 or later.
What type of vulnerability is CVE-2026-26276?
CVE-2026-26276 is a DOM-based Cross-Site Scripting (XSS) vulnerability.
Who is affected by CVE-2026-26276?
CVE-2026-26276 affects users of Gogs prior to version 0.14.2.
What can an attacker do with CVE-2026-26276?
An attacker can store a malicious HTML/JavaScript payload in a repository’s Milestone name, leading to potential XSS attacks when viewed by other users.