CVE-2026-26022

HIGH8.7EPSS 0.02%

Gogs: Stored XSS via data URI in issue comments in gogs.io/gogs

發布日:2026/3/5修改日:2026/3/23

也稱為:GHSA-xrcr-gmf5-2r8jGO-2026-4620

描述

Gogs: Stored XSS via data URI in issue comments in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: gogs.io/gogs before v0.14.2.

受影響套件(2)

Go/gogs.io/gogsfrom 0, < 0.14.2
Go/gogs.io/gogsfrom 0

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH8.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

參考連結(6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-26022
PATCHhttps://github.com/gogs/gogs
WEBhttps://github.com/gogs/gogs/commit/441c64d7bd8893b2f4e48660a8be3a7472e14291
WEBhttps://github.com/gogs/gogs/pull/8174
WEBhttps://github.com/gogs/gogs/releases/tag/v0.14.2
WEBhttps://github.com/gogs/gogs/security/advisories/GHSA-xrcr-gmf5-2r8j