CVE-2026-26276

Description

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, an attacker can store an HTML/JavaScript payload in a repository’s Milestone name, and when another user selects that Milestone on the New Issue page (/issues/new), a DOM-Based XSS is triggered. This issue has been patched in version 0.14.2.

PUBLISHED Reserved 2026-02-12 | Published 2026-03-05 | Updated 2026-03-07 | Assigner GitHub_M

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

References

github.com/gogs/gogs/security/advisories/GHSA-vgjm-2cpf-4g7c

github.com/gogs/gogs/pull/8178

github.com/gogs/gogs/releases/tag/v0.14.2

cve.org (CVE-2026-26276)

nvd.nist.gov (CVE-2026-26276)

Download JSON