CVE-2026-59102: Forgejo < 15.0.3 - Stored XSS via Actions Run Full Name Rendering
Forgejo before 15.0.3 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by setting a full name containing an HTML payload and triggering an Actions run. When the DEFAULTSHOWFULLNAME option is enabled, the run description is assembled server-side with the user's display name interpolated into an HTML string via a translation function that does not escape its arguments, and the frontend renders the result using a Vue v-html binding, causing script execution for any user who views the affected Actions run page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Forgejoto a version that resolves this vulnerability.Fixed in 15.0.3 - Configuration
Disable the DEFAULT_SHOW_FULL_NAME option so the Actions run description is not assembled using unescaped user full name rendered via the Vue v-html binding.
Forgejo Actions DEFAULT_SHOW_FULL_NAME = disabled - Compensating control
Restrict access to Forgejo Actions run pages to trusted users until the Forgejo upgrade to 15.0.3 (or later) is completed to reduce exposure of stored XSS payload execution.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59102?
The severity of CVE-2026-59102 is classified as low with a score of 2.1.
What type of vulnerability is CVE-2026-59102?
CVE-2026-59102 is a stored cross-site scripting (XSS) vulnerability.
How do I fix CVE-2026-59102?
To fix CVE-2026-59102, update Forgejo to version 15.0.3 or later.
Who can exploit CVE-2026-59102?
CVE-2026-59102 can be exploited by authenticated attackers who can modify the full name field.
What are the consequences of CVE-2026-59102?
The consequences of CVE-2026-59102 include the ability to execute arbitrary JavaScript in other users' browsers.