GOGS.IO/GOGS · CVE-2026-52807 · Package
FIX → 0.14.3
A milestone name containing HTML or JavaScript is rendered unsafely by the Semantic UI milestone dropdown on the New Issue page, so the script runs in the browser of anyone who opens that page and uses the dropdown. An attacker who can create milestones in a repository can steal session cookies and act as the victim.
first public Jun 19, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any self-hosted Gogs instance below 0.14.3 where users with write access to a repository can create milestones. Other users who open the New Issue page and pick a milestone are the ones who run the payload, so the exposure is within the instance's own user base. Instances with no untrusted users who can create milestones are at lower risk.
Not affected if gogs-0.14.3-or-later, no-untrusted-write-users
Who cares go, gogs, self-hosted
gogs --version or the binary's release notes; versions below 0.14.3 are affected.templates/repo/issue/new_form.tmpl in the Gogs source tree and see whether the milestone name is rendered without the | Sanitize filter that view_content.tmpl uses.Upgrade to 0.14.3
The fix for GHSA-vgjm-2cpf-4g7c (DOM-based XSS via milestone selection) was only applied to templates/repo/issue/view_content.tmpl but not to templates/repo/issue/new_form.tmpl. An attacker can store an HTML/JavaScript payload in a milestone name, and when any user opens the New Issue page and interacts with the milestone dropdown, the payload executes in their browser via Semantic UI's preserveHTML behavior.
GHSA-vgjm-2cpf-4g7c was patched by adding | Sanitize (bluemonday HTML tag stripping) to milestone name rendering in view_content.tmpl. However, the same milestone dropdown exists in new_form.tmpl and was not patched.
In new_form.tmpl, milestone names are rendered with Go's default auto-escaping ({{.Name}}), which converts < to < etc. This prevents direct HTML injection. However, when the browser renders the DOM, the text content of the element contains the original payload (e.g., ).
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
0.14.3.<img src=x onerror=alert(1)>Semantic UI 2.4.2's dropdown component has preserveHTML: true as the default setting. When a user selects a dropdown item, the internal set.text() method calls jQuery's .html() with the item's text content. This re-parses the decoded text as HTML, creating the injected element and triggering the JavaScript event handler.
poc.zip Please extract the uploaded compressed file before proceeding
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.