VulnerabilityAnalyzed

CVE-2026-26195

Prior to version 0.14.2, stored xss is still possible through unsafe template rendering that mixes user input with safe plus permissive sanitizer handling of data urls.

MEDIUM 6.9EPSS 0.19%

Does this matter?

Lower severity and a low EPSS score (0.19%). Track it; it rarely justifies an emergency change on its own.

Description

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, stored xss is still possible through unsafe template rendering that mixes user input with safe plus permissive sanitizer handling of data urls. This issue has been patched in version 0.14.2.

CVSS 4.0: 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.19% probability · 9th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: gogs/gogs
Source: security-advisories@github.com

References

https://github.com/gogs/gogs/commit/ac21150a53bef3a3061f4da787ab193a8d68ecfcPatch
https://github.com/gogs/gogs/pull/8176Issue Tracking
https://github.com/gogs/gogs/releases/tag/v0.14.2Release Notes
https://github.com/gogs/gogs/security/advisories/GHSA-vgvf-m4fw-938jVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.