CVE-2026-52798 Details
Description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, although .ipynb previews are sanitized on the server side via /-/api/sanitize_ipynb, the inserted content is re-rendered on the client side without sanitization using marked() on elements with the .nb-markdown-cell class. During this process, links containing schemes such as javascript: can be regenerated. As a result, when a victim views an attacker-crafted .ipynb file and clicks the link, arbitrary JavaScript is executed in the Gogs origin, leading to a click-based Stored XSS. This vulnerability is fixed in 0.14.3.
A stored cross-site scripting vulnerability has been identified in Gogs, an open-source self-hosted Git service, in versions prior to 0.14.3. The issue arises in the preview of Jupyter notebook files (.ipynb). Although the content is sanitized on the server side, the Markdown cells are re-rendered on the client side using the 'marked()' function without proper sanitization. This allows the regeneration of links with 'javascript:' schemes. When a user clicks such a link in a crafted .ipynb file, it executes arbitrary JavaScript in the Gogs origin, creating a click-based stored XSS.
Users can upgrade to Gogs version 0.14.3, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 24, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gogs/gogs/security/advisories/GHSA-jq8v-rmf6-65jw | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/gogs/gogs/commit/17b168b11ca759a7550e1f4bbd68bbde14db7785 | [email protected] | Source CodeVendor |
| https://github.com/gogs/gogs/pull/8319 | [email protected] | Issue TrackingVendor |
| https://github.com/gogs/gogs/releases/tag/v0.14.3 | [email protected] | Release NotesVendor |
| https://github.com/gogs/gogs/security/advisories/GHSA-jq8v-rmf6-65jw | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Gogs | <= 0.14.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |