{"id":"CVE-2026-52807","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-52807","generatedAt":"2026-10-28T10:40:33.412Z","title":"This prevents direct HTML injection.","description":"Gogs is an open source self-hosted Git service. Prior to 0.14.3, in new_form.tmpl, milestone names are rendered with Go's default auto-escaping ({{.Name}}), which converts < to &lt; etc. This prevents direct HTML injection. However, when the browser renders the DOM, the text content of the element contains the decoded original payload. Semantic UI 2.4.2's dropdown component has preserveHTML: true as the default setting. When a user selects a dropdown item, the internal set.text() method calls jQuery's .html() with the item's text content. This re-parses the decoded text as HTML, creating the injected element and triggering the JavaScript event handler. An attacker can store an HTML/JavaScript payload in a milestone name, and when any user opens the New Issue page and interacts with the milestone dropdown, the payload executes in their browser via Semantic UI's preserveHTML behavior. This vulnerability is fixed in 0.14.3.","published":"2026-06-24T21:16:57.000Z","lastModified":"2026-06-25T16:16:39.000Z","status":"Deferred","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"4.0","score":4.8,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-79"],"affected":[],"epss":{"score":0.00483,"percentile":0.41448,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.48%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/gogs/gogs/commit/573eacdc658641487f8ad883da96b29ec8e2852d","source":"security-advisories@github.com"},{"url":"https://github.com/gogs/gogs/pull/8325","source":"security-advisories@github.com"},{"url":"https://github.com/gogs/gogs/releases/tag/v0.14.3","source":"security-advisories@github.com"},{"url":"https://github.com/gogs/gogs/security/advisories/GHSA-vcm5-gvmp-78mp","source":"security-advisories@github.com"},{"url":"https://github.com/gogs/gogs/security/advisories/GHSA-vcm5-gvmp-78mp","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-52807","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}