CVE-2025-68942: Gitea XSS Vulnerability in Search Input

CVE-2025-68942 Overview

CVE-2025-68942 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Gitea versions before 1.22.2. The flaw exists in the search input box used for creating tags and branches, which renders user-supplied content with Vue.js v-html instead of the safer v-text directive. An authenticated attacker can inject arbitrary HTML or JavaScript that executes in the browser of a victim user who interacts with the affected interface. The vulnerability requires low privileges and user interaction, and it crosses a trust boundary (scope change) to affect other components.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in victim browsers, leading to session hijacking, repository manipulation, or theft of authentication tokens.

Affected Products

Gitea versions prior to 1.22.2
Self-hosted Gitea Git service deployments
Any Gitea instance exposing tag and branch creation UI to authenticated users

Discovery Timeline

2025-12-26 - CVE-2025-68942 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2025-68942

Vulnerability Analysis

The vulnerability resides in Gitea's front-end Vue.js templates for the tag and branch creation workflow. The search input box binds user-supplied text using the v-html directive, which renders raw HTML into the DOM. Any string containing HTML tags or JavaScript event handlers is parsed and executed by the browser.

The exploitation path requires an authenticated user with permission to create or search tags and branches. The attacker supplies a crafted repository, branch, or tag name containing an HTML payload. When another user views the search input in a vulnerable context, the injected script executes within the Gitea origin.

Because the Common Vulnerability Scoring System (CVSS) vector indicates a scope change, the executed script can affect resources beyond the vulnerable component, including the victim's authenticated session and cross-repository actions available to that user.

Root Cause

The root cause is improper neutralization of input during web page generation. The Vue template uses v-html where v-text would be appropriate. The v-html directive bypasses Vue's default HTML escaping and inserts the raw string into the DOM, trusting that the content is safe. For a search box backed by user-controlled values such as branch and tag names, that assumption is incorrect.

Attack Vector

An attacker with low-privileged access to a Gitea instance crafts a repository artifact (branch, tag, or search term) containing an HTML or JavaScript payload. The attacker then lures a victim user to interact with the tag or branch search interface. On render, the browser executes the payload under the Gitea origin, allowing the attacker to perform API calls, read Document Object Model (DOM) content, or exfiltrate session cookies not protected by HttpOnly.

See the Gitea pull request 31966 for the upstream fix and the Gitea 1.22.2 release notes for the complete remediation changelog.

Detection Methods for CVE-2025-68942

Indicators of Compromise

Branch, tag, or repository names containing HTML tags such as <script>, <img onerror=...>, or <svg onload=...>
Unexpected outbound requests from authenticated user browsers to attacker-controlled domains originating from Gitea pages
Audit log entries showing branch or tag creation with suspicious non-standard characters in the name field

Detection Strategies

Review Gitea access logs for POST and GET requests to tag and branch endpoints containing URL-encoded HTML syntax
Inspect database tables storing branch and tag metadata for entries containing <, >, or JavaScript protocol handlers
Deploy Content Security Policy (CSP) reporting to flag inline script execution attempts on Gitea pages

Monitoring Recommendations

Enable verbose request logging on Gitea and forward logs to a Security Information and Event Management (SIEM) platform for pattern-based alerting
Monitor for anomalous session activity such as rapid API calls following a user visit to a repository tag or branch page
Alert on creation of repository objects whose names fail an allowlist of alphanumeric, dash, underscore, and slash characters

How to Mitigate CVE-2025-68942

Immediate Actions Required

Upgrade all Gitea instances to version 1.22.2 or later without delay
Audit existing branches, tags, and repository names for HTML or script content and remove or rename offending entries
Rotate session tokens and API keys for users who may have interacted with crafted repositories prior to patching

Patch Information

The fix is included in Gitea 1.22.2, which replaces the vulnerable v-html binding with v-text in the tag and branch search input. Download the patched release from the Gitea 1.22.2 release page and review the Gitea 1.22.2 blog announcement for upgrade guidance.

Workarounds

Restrict repository, branch, and tag creation to trusted users until the patch is applied
Enforce a strict Content Security Policy on the Gitea deployment to block inline script execution
Place Gitea behind a web application firewall (WAF) with rules that reject requests containing HTML tags in repository metadata fields

bash

# Example: upgrade Gitea on a systemd-managed host
systemctl stop gitea
wget https://dl.gitea.com/gitea/1.22.2/gitea-1.22.2-linux-amd64 -O /usr/local/bin/gitea
chmod +x /usr/local/bin/gitea
systemctl start gitea
systemctl status gitea