---
id: "CVE-2026-52807"
page: "https://infrastack.ai/live/CVE-2026-52807"
kind: "vulnerability"
aliases: ["CVE-2026-52807", "GHSA-vcm5-gvmp-78mp"]
title: "Gogs has DOM-based XSS via Milestone Name on New Issue Page"
severity: "medium"
cvss: 4.8
epss: 0.00483
exploited: false
status: "open"
category: "package"
products: [{"name": "gogs.io/gogs", "fixed": ["0.14.3"], "affected": "< 0.14.3", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["cwe-79", "go", "gogs", "package", "self-hosted"]
not_affected_if: ["gogs-0.14.3-or-later", "no-untrusted-write-users"]
published_at: "2026-06-23T17:02:52+00:00"
first_seen_at: "2026-11-09T01:50:07+00:00"
updated_at: "2026-11-09T01:54:15+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-vcm5-gvmp-78mp", "first_seen_at": "2026-11-09T01:50:07+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52807", "first_seen_at": "2026-11-09T01:54:15+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.00483, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-52807"}]
---

# Gogs has DOM-based XSS via Milestone Name on New Issue Page

Link for people: https://infrastack.ai/live/CVE-2026-52807 (this .md is for agents)

A milestone name containing HTML or JavaScript is rendered unsafely by the Semantic UI milestone dropdown on the New Issue page, so the script runs in the browser of anyone who opens that page and uses the dropdown. An attacker who can create milestones in a repository can steal session cookies and act as the victim.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:gogs.io/gogs affected < 0.14.3 fixed 0.14.3

## How to check

- Check the installed Gogs version with `gogs --version` or the binary's release notes; versions below `0.14.3` are affected.
- Look at `templates/repo/issue/new_form.tmpl` in the Gogs source tree and see whether the milestone name is rendered without the `| Sanitize` filter that `view_content.tmpl` uses.

## Fix

- Gogs: move to `0.14.3`.

## Timeline

- 2026-11-09T01:50:07+00:00 ghsa https://github.com/advisories/GHSA-vcm5-gvmp-78mp
- 2026-11-09T01:54:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-52807

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/gogs/gogs/security-advisories/GHSA-vcm5-gvmp-78mp
- [advisory] Maintainer's advisory: github.com https://github.com/gogs/gogs/security/advisories/GHSA-vcm5-gvmp-78mp
- [fix] Patch: github.com https://github.com/gogs/gogs/pull/8325
- [fix] Patch: github.com https://github.com/gogs/gogs/commit/573eacdc658641487f8ad883da96b29ec8e2852d
- [fix] Release: github.com https://github.com/gogs/gogs/releases/tag/v0.14.3

## From the sources

### Summary
The fix for GHSA-vgjm-2cpf-4g7c (DOM-based XSS via milestone selection) was only applied to `templates/repo/issue/view_content.tmpl` but not to `templates/repo/issue/new_form.tmpl`. An attacker can store an HTML/JavaScript payload in a milestone name, and when any user opens the New Issue page and interacts with the milestone dropdown, the payload executes in their browser via Semantic UI's `preserveHTML` behavior.

### Details
GHSA-vgjm-2cpf-4g7c was patched by adding `| Sanitize` (bluemonday HTML tag stripping) to milestone name rendering in `view_content.tmpl`. However, the same milestone dropdown exists in `new_form.tmpl` and was **not** patched.

In `new_form.tmpl`, milestone names are rendered with Go's default auto-escaping (`{{.Name}}`), which converts `<` to `&lt;` etc. This prevents direct HTML injection. However, when the browser renders the DOM, the text content of the element contains the **decoded** original payload (e.g., `<img src=x onerror=alert(1)>`).

Semantic UI 2.4.2's dropdown component has `preserveHTML: true` as the default setting. When a user selects a dropdown item, the internal `set.text()` method calls jQuery's `.html()` with the item's text content. This re-parses the decoded text as HTML, creating the injected element and triggering the JavaScript event handler.

### PoC
[poc.zip](https://github.com/user-attachments/files/26508268/poc.zip)
Please extract the uploaded compressed file before proceeding

1. docker compose up --build

<img width="1325" height="315" alt="스크린샷 2026-04-06 오후 9 34 05" src="https://github.com/user-attachments/assets/87895cce-5b8e-4320-829a-87a5890cc0d9" />

### Impact
- Stored DOM XSS: Any user with write access to a repository can create a malicious milestone. Any other user who visits the New Issue page and interacts with the milestone dropdown will have arbitrary JavaScript executed in their browser session.
- Session hijacking: The attacker can steal session cookies, perform actions as the victim, or escalate privileges.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_