{"id":"CVE-2026-52807","kind":"vulnerability","aliases":["CVE-2026-52807","GHSA-vcm5-gvmp-78mp"],"related":[],"title":"Gogs has DOM-based XSS via Milestone Name on New Issue Page","description":"### Summary\nThe fix for GHSA-vgjm-2cpf-4g7c (DOM-based XSS via milestone selection) was only applied to `templates/repo/issue/view_content.tmpl` but not to `templates/repo/issue/new_form.tmpl`. An attacker can store an HTML/JavaScript payload in a milestone name, and when any user opens the New Issue page and interacts with the milestone dropdown, the payload executes in their browser via Semantic UI's `preserveHTML` behavior.\n\n### Details\nGHSA-vgjm-2cpf-4g7c was patched by adding `| Sanitize` (bluemonday HTML tag stripping) to milestone name rendering in `view_content.tmpl`. However, the same milestone dropdown exists in `new_form.tmpl` and was **not** patched.\n\nIn `new_form.tmpl`, milestone names are rendered with Go's default auto-escaping (`{{.Name}}`), which converts `<` to `<` etc. This prevents direct HTML injection. However, when the browser renders the DOM, the text content of the element contains the **decoded** original payload (e.g., ``).\n\nSemantic UI 2.4.2's dropdown component has `preserveHTML: true` as the default setting. When a user selects a dropdown item, the internal `set.text()` method calls jQuery's `.html()` with the item's text content. This re-parses the decoded text as HTML, creating the injected element and triggering the JavaScript event handler.\n\n### PoC\n[poc.zip](https://github.com/user-attachments/files/26508268/poc.zip)\nPlease extract the uploaded compressed file before proceeding\n\n1. docker compose up --build\n\n\"스크린샷\n\n### Impact\n- Stored DOM XSS: Any user with write access to a repository can create a malicious milestone. Any other user who visits the New Issue page and interacts with the milestone dropdown will have arbitrary JavaScript executed in their browser session.\n- Session hijacking: The attacker can steal session cookies, perform actions as the victim, or escalate privileges.","summary":"A milestone name containing HTML or JavaScript is rendered unsafely by the Semantic UI milestone dropdown on the New Issue page, so the script runs in the browser of anyone who opens that page and uses the dropdown. An attacker who can create milestones in a repository can steal session cookies and act as the victim.","severity":"medium","cvss":4.8,"epss":0.00483,"exploited":false,"exploited_at":null,"products":[{"name":"gogs.io/gogs","fixed":["0.14.3"],"affected":"< 0.14.3","ecosystem":"go"}],"ecosystems":["go"],"tags":["cwe-79","go","gogs","package","self-hosted"],"not_affected_if":["gogs-0.14.3-or-later","no-untrusted-write-users"],"how_to_check":"- Check the installed Gogs version with `gogs --version` or the binary's release notes; versions below `0.14.3` are affected.\n- Look at `templates/repo/issue/new_form.tmpl` in the Gogs source tree and see whether the milestone name is rendered without the `| Sanitize` filter that `view_content.tmpl` uses.","fix":"- Gogs: move to `0.14.3`.","status":"open","published_at":"2026-06-23T17:02:52+00:00","first_seen_at":"2026-11-09T01:50:07+00:00","triaged_at":"2026-11-09T01:50:47+00:00","updated_at":"2026-11-09T01:54:15+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T01:50:47Z","model":"claude-haiku-5-5","output":{"fix":"- Gogs: move to `0.14.3`.","reach":"network","title":"Gogs: milestone name runs script on the New Issue page","impact":"medium","summary":"A milestone name containing HTML or JavaScript is rendered unsafely by the Semantic UI milestone dropdown on the New Issue page, so the script runs in the browser of anyone who opens that page and uses the dropdown. An attacker who can create milestones in a repository can steal session cookies and act as the victim.","audience":"businesses","category":"package","nicknames":[],"who_cares":["gogs","self-hosted","go"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Victim's browser session runs attacker script and cookies can be stolen.","analyst_note":"","how_to_check":"- Check the installed Gogs version with `gogs --version` or the binary's release notes; versions below `0.14.3` are affected.\n- Look at `templates/repo/issue/new_form.tmpl` in the Gogs source tree and see whether the milestone name is rendered without the `| Sanitize` filter that `view_content.tmpl` uses.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["gogs-0.14.3-or-later","no-untrusted-write-users"],"who_is_affected":"Any self-hosted Gogs instance below 0.14.3 where users with write access to a repository can create milestones. Other users who open the New Issue page and pick a milestone are the ones who run the payload, so the exposure is within the instance's own user base. Instances with no untrusted users who can create milestones are at lower risk.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000841,"input_tokens":5352,"output_tokens":611,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,23A '-52807':16A,24A '-79':29B '/gogs':27A '/user-attachments/files/26508268/poc.zip)':293C '1':235C,302C '2.4.2':238C '2cpf':99C,159C '4g7c':100C,160C '78mp':21A 'access':315C 'act':88B 'action':357C 'add':164C 'alert':234C 'anyon':65B 'appli':110C 'arbitrari':341C 'attack':75B,118C,351C 'auto':199C 'auto-escap':198C 'base':5A,103C 'behavior':154C 'bluemonday':166C 'browser':63B,148C,214C,346C 'build':306C 'call':260C 'compon':241C 'compos':304C 'compress':298C 'contain':39B,224C 'content':220C,269C 'convert':203C 'cooki':86B,355C 'creat':78B,279C,320C 'cve':14A,22A 'cwe':28B 'decod':226C,275C 'default':197C,247C 'detail':155C 'direct':208C 'docker':303C 'dom':4A,102C,217C,309C 'dom-bas':3A,101C 'dropdown':51B,73B,142C,180C,240C,254C,338C 'e.g':229C 'element':223C,282C 'escal':362C 'escap':200C 'etc':205C 'event':287C 'execut':145C,343C 'exist':181C 'extract':295C 'file':299C 'fix':94C 'ghsa':18A,97C,157C 'ghsa-vcm5-gvmp-78mp':17A 'ghsa-vgjm-2cpf-4g7c':96C,156C 'github.com':292C 'github.com/user-attachments/files/26508268/poc.zip)':291C 'go':30B,195C 'gog':1A,31B 'gogs.io':26A 'gogs.io/gogs':25A 'gvmp':20A 'handler':288C 'hijack':349C 'host':35B 'howev':176C,211C 'html':40B,167C,209C,263C,278C 'html/javascript':122C 'img':230C 'impact':307C 'inject':210C,281C 'interact':138C,334C 'intern':257C 'issu':12A,55B,135C,331C 'item':255C,266C 'javascript':42B,286C,342C 'jqueri':261C 'malici':322C 'method':259C 'mileston':8A,37B,50B,79B,106C,126C,141C,171C,179C,190C,323C,337C 'name':9A,38B,127C,172C,191C,201C 'new':11A,54B,134C,330C 'new_form.tmpl':183C,189C 'onerror':233C 'open':67B,132C 'origin':227C 'packag':32B 'page':13A,56B,69B,136C,332C 'pars':273C 'patch':162C,187C 'payload':123C,144C,228C 'perform':356C 'pleas':294C 'poc':289C 'poc.zip':290C 'preservehtml':153C,243C 'prevent':207C 'privileg':363C 'proceed':301C 're':272C 're-pars':271C 'render':44B,173C,193C,215C 'repositori':82B,318C 'run':60B 'sanit':165C 'script':59B 'select':107C,252C 'self':34B 'self-host':33B 'semant':48B,150C,236C 'session':85B,347C,348C,354C 'set':248C 'set.text':258C 'src':231C 'steal':84B,353C 'store':120C,308C 'strip':169C 'summari':92C 'tag':168C 'templates/repo/issue/new_form.tmpl':116C 'templates/repo/issue/view_content.tmpl':112C 'text':219C,268C,276C 'trigger':284C 'true':244C 'ui':49B,151C,237C 'unsaf':45B 'upload':297C 'use':71B 'user':131C,251C,312C,326C 'vcm5':19A 'vgjm':98C,158C 'via':7A,105C,149C 'victim':91B,360C 'view_content.tmpl':175C 'visit':328C 'write':314C 'x':232C 'xss':6A,104C,310C","nicknames":[],"mitigations":[],"who_affected":"Any self-hosted Gogs instance below 0.14.3 where users with write access to a repository can create milestones. Other users who open the New Issue page and pick a milestone are the ones who run the payload, so the exposure is within the instance's own user base. Instances with no untrusted users who can create milestones are at lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["gogsiogogs"],"ptokens":["gogs","io"],"labels":["cwe79","go","gogs","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-2026':15A,23A '-52807':16A,24A '/gogs':27A '78mp':21A 'base':5A 'cve':14A,22A 'dom':4A 'dom-bas':3A 'ghsa':18A 'ghsa-vcm5-gvmp-78mp':17A 'gog':1A 'gogs.io':26A 'gogs.io/gogs':25A 'gvmp':20A 'issu':12A 'mileston':8A 'name':9A 'new':11A 'page':13A 'vcm5':19A 'via':7A 'xss':6A","search_b":"'-79':29B 'act':88B 'anyon':65B 'attack':75B 'browser':63B 'contain':39B 'cooki':86B 'creat':78B 'cwe':28B 'dropdown':51B,73B 'go':30B 'gog':31B 'host':35B 'html':40B 'issu':55B 'javascript':42B 'mileston':37B,50B,79B 'name':38B 'new':54B 'open':67B 'packag':32B 'page':56B,69B 'render':44B 'repositori':82B 'run':60B 'script':59B 'self':34B 'self-host':33B 'semant':48B 'session':85B 'steal':84B 'ui':49B 'unsaf':45B 'use':71B 'victim':91B","search_c":"'/user-attachments/files/26508268/poc.zip)':293C '1':235C,302C '2.4.2':238C '2cpf':99C,159C '4g7c':100C,160C 'access':315C 'action':357C 'add':164C 'alert':234C 'appli':110C 'arbitrari':341C 'attack':118C,351C 'auto':199C 'auto-escap':198C 'base':103C 'behavior':154C 'bluemonday':166C 'browser':148C,214C,346C 'build':306C 'call':260C 'compon':241C 'compos':304C 'compress':298C 'contain':224C 'content':220C,269C 'convert':203C 'cooki':355C 'creat':279C,320C 'decod':226C,275C 'default':197C,247C 'detail':155C 'direct':208C 'docker':303C 'dom':102C,217C,309C 'dom-bas':101C 'dropdown':142C,180C,240C,254C,338C 'e.g':229C 'element':223C,282C 'escal':362C 'escap':200C 'etc':205C 'event':287C 'execut':145C,343C 'exist':181C 'extract':295C 'file':299C 'fix':94C 'ghsa':97C,157C 'ghsa-vgjm-2cpf-4g7c':96C,156C 'github.com':292C 'github.com/user-attachments/files/26508268/poc.zip)':291C 'go':195C 'handler':288C 'hijack':349C 'howev':176C,211C 'html':167C,209C,263C,278C 'html/javascript':122C 'img':230C 'impact':307C 'inject':210C,281C 'interact':138C,334C 'intern':257C 'issu':135C,331C 'item':255C,266C 'javascript':286C,342C 'jqueri':261C 'malici':322C 'method':259C 'mileston':106C,126C,141C,171C,179C,190C,323C,337C 'name':127C,172C,191C,201C 'new':134C,330C 'new_form.tmpl':183C,189C 'onerror':233C 'open':132C 'origin':227C 'page':136C,332C 'pars':273C 'patch':162C,187C 'payload':123C,144C,228C 'perform':356C 'pleas':294C 'poc':289C 'poc.zip':290C 'preservehtml':153C,243C 'prevent':207C 'privileg':363C 'proceed':301C 're':272C 're-pars':271C 'render':173C,193C,215C 'repositori':318C 'sanit':165C 'select':107C,252C 'semant':150C,236C 'session':347C,348C,354C 'set':248C 'set.text':258C 'src':231C 'steal':353C 'store':120C,308C 'strip':169C 'summari':92C 'tag':168C 'templates/repo/issue/new_form.tmpl':116C 'templates/repo/issue/view_content.tmpl':112C 'text':219C,268C,276C 'trigger':284C 'true':244C 'ui':151C,237C 'upload':297C 'user':131C,251C,312C,326C 'vgjm':98C,158C 'via':105C,149C 'victim':360C 'view_content.tmpl':175C 'visit':328C 'write':314C 'x':232C 'xss':104C,310C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-06-19T02:19:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-vcm5-gvmp-78mp","url":"https://github.com/advisories/GHSA-vcm5-gvmp-78mp","severity":"medium","published_at":"2026-06-23T17:02:52+00:00","modified_at":"2026-11-09T01:46:08+00:00","first_seen_at":"2026-11-09T01:50:07+00:00","fetched_at":"2026-11-09T01:57:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-52807","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52807","severity":null,"published_at":"2026-06-24T21:16:56+00:00","modified_at":"2026-06-25T16:16:38+00:00","first_seen_at":"2026-11-09T01:54:15+00:00","fetched_at":"2026-11-09T01:54:15+00:00","note":null}],"documents":[{"id":105099,"url":"https://api.github.com/repos/gogs/gogs/security-advisories/GHSA-vcm5-gvmp-78mp","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":105100,"url":"https://github.com/gogs/gogs/security/advisories/GHSA-vcm5-gvmp-78mp","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-06-19T02:19:30+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":105101,"url":"https://github.com/gogs/gogs/pull/8325","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":105102,"url":"https://github.com/gogs/gogs/commit/573eacdc658641487f8ad883da96b29ec8e2852d","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":105103,"url":"https://github.com/gogs/gogs/releases/tag/v0.14.3","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[{"type":"epss","score":0.00483,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-52807"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}