CVE-2026-26022Disclosure(gogs / gogs)

LOWCVSS 5.4 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch gogs gogs systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, a stored cross-site scripting (XSS) vulnerability exists in the comment and issue description functionality. The application's HTML sanitizer explicitly allows data: URI schemes, enabling authenticated users to inject arbitrary JavaScript execution via malicious links. This issue has been patched in version 0.14.2.

gogs CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/gogs/gogs/commit/441c64d7bd8893b2f4e48660a8be3a7472e14291

Exploit / PoC references

https://github.com/gogs/gogs/security/advisories/GHSA-xrcr-gmf5-2r8j

Other references

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

gogs

Threat summary

Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
Disclosure: 3 classified signals
Peaked 2d ago at 2 mentions (2026-03-05); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

gogs

Products

gogs

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

Disclosure

375.0%

Patch

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-05	2	Disclosure1Patch1
2026-03-06	1	Disclosure1
2026-03-08	1	Disclosure1

Full discourse4 posts

The Hacker Wire@TheHackerWire214d
Disclosure
🟠 CVE-2026-26022 - High Gogs is an open source self-hosted Git service. Prior to version 0.14.2, a stored cross-site scripting (XSS) vulnerability exists in the comment and issue description functionality. The appli... https://www.thehackerwire.com/vulnerability/CVE-2026-26022/ https://t.co/LeZwkCq8cR
Post summary
The tweet announces a stored XSS vulnerability (CVE‑2026‑26022) affecting Gogs before v0.14.2, providing technical details without mentioning exploits, PoCs, or patches.
0000045
130 followersView on X
DailyCVE@dailycve216d
Disclosure
🔴 Gogs, Stored Cross-Site Scripting (XSS), #CVE-2026-26022 (High) https://dailycve.com/gogs-stored-cross-site-scripting-xss-cve-2026-26022-high/
Post summary
A CVE for Gogs (CVE‑2026‑26022) is disclosed, detailing a stored XSS vulnerability; the post contains no PoC, exploit, patch, or active exploitation information.
0000028
166 followersView on X
CVEFind.com@CveFindCom217d
Patch
[CVE-2026-26022: HIGH] Beware of Gogs version 0.14.2 and earlier! A stored cross-site scripting vulnerability in comment & issue description could enable JS execution via malicious links. Update to version 0...#cve,CVE-2026-26022,#cybersecurity https://cvefind.com/CVE-2026-26022
Post summary
The post alerts of a high‑severity stored XSS flaw in Gogs and urges users to upgrade to a patched version.
0000054
598 followersView on X
CVE@CVEnew217d
Disclosure
CVE-2026-26022 Gogs is an open source self-hosted Git service. Prior to version 0.14.2, a stored cross-site scripting (XSS) vulnerability exists in the comment and issue description… https://www.cve.org/CVERecord?id=CVE-2026-26022
Post summary
The message announces a stored XSS vulnerability in Gogs before version 0.14.2, providing the CVE identifier but no PoC, exploit, active exploitation, or patch information.
0000094
56.6K followersView on X