Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in gogs - #VU134899
Published: June 19, 2026
Vulnerability identifier: #VU134899
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-80
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary script in the victim's browser.
The vulnerability exists due to improper neutralization of script-related html tags in a web page in the .ipynb file renderer when rendering user-supplied Jupyter notebook files. A remote user can create a crafted repository file and trick the victim into visiting the rendered file to execute arbitrary script in the victim's browser.
The issue can lead to account takeover when the victim views the malicious notebook file.
Affected software
gogs
Remediation
Install security update from vendor's website.
gogs - update to 0.14.3