CVE-2026-26022: Gogs Git Service Stored XSS Vulnerability

CVE-2026-26022 Overview

CVE-2026-26022 is a stored cross-site scripting (XSS) vulnerability affecting Gogs, an open source self-hosted Git service. Prior to version 0.14.2, the application's HTML sanitizer explicitly allows data: URI schemes in comment and issue description functionality, enabling authenticated users to inject arbitrary JavaScript execution via malicious links. This vulnerability allows attackers to persist malicious scripts that execute in victims' browsers when viewing affected content.

Critical Impact

Authenticated attackers can inject persistent JavaScript payloads through comments and issue descriptions, potentially leading to session hijacking, credential theft, and unauthorized actions on behalf of other users within the Gogs application.

Affected Products

• Gogs versions prior to 0.14.2
• Self-hosted Git service installations using vulnerable Gogs releases
• Any Gogs deployment with comment and issue functionality enabled

Discovery Timeline

• 2026-03-05 - CVE-2026-26022 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-26022

Vulnerability Analysis

This stored XSS vulnerability stems from insufficient input sanitization in Gogs' markup processing component. The HTML sanitizer used by the application explicitly permits data: URI schemes without proper restrictions, creating an attack surface for JavaScript injection. When an authenticated user crafts a malicious link using a data: URI containing JavaScript code and embeds it in a comment or issue description, the payload becomes persistently stored in the database.

When other users view the affected content, their browsers interpret and execute the injected JavaScript within the context of the Gogs application. This can lead to session token theft, unauthorized actions performed on behalf of victims, defacement of repository content, or redirection to malicious external sites. The attack requires network access and user interaction (viewing the malicious content), but the scope change allows the vulnerability to impact resources beyond the vulnerable component.

Root Cause

The vulnerability exists in the internal/markup/sanitizer.go file where the HTML sanitization policy was configured to allow data: URI schemes broadly without restricting them to safe MIME types. The bluemonday HTML sanitizer library provides flexible configuration options, but the Gogs implementation failed to properly constrain data URIs to only permit safe content types like images.

Attack Vector

The attack vector is network-based and requires authentication to inject the payload, but only user interaction (viewing) to trigger execution. An attacker with a valid Gogs account can:

1. Navigate to any issue or pull request comment section
2. Insert a crafted link using a data: URI containing encoded JavaScript
3. Submit the comment, persisting the payload
4. Wait for victims to view the affected content, triggering script execution

The security patch addresses this by restricting data: URI schemes to only safe image MIME types:

 package markup
 
 import (
+	"net/url"
+	"strings"
 	"sync"
 
 	"github.com/microcosm-cc/bluemonday"

Source: GitHub Commit Update

Detection Methods for CVE-2026-26022

Indicators of Compromise

• Presence of data: URIs containing JavaScript or non-image MIME types in issue descriptions or comments
• Unusual data:text/html or data:application/javascript patterns in stored content
• User reports of unexpected browser behavior when viewing specific issues or comments
• Audit logs showing suspicious comment or issue edit activity from compromised accounts

Detection Strategies

• Implement content security policy (CSP) headers to restrict inline script execution
• Deploy web application firewalls (WAF) with rules to detect data: URI injection patterns
• Monitor database content for data: URIs with non-image MIME types in comment and issue tables
• Enable browser-side XSS auditing and report violations to security monitoring systems

Monitoring Recommendations

• Audit stored content periodically for malicious data: URI patterns
• Monitor user session activity for signs of session hijacking following XSS exploitation
• Review Gogs access logs for unusual patterns indicating automated exploitation attempts
• Configure SentinelOne endpoint protection to detect and block malicious script execution in browser contexts

How to Mitigate CVE-2026-26022

Immediate Actions Required

• Upgrade Gogs to version 0.14.2 or later immediately
• Audit existing issue descriptions and comments for potentially malicious data: URI content
• Implement Content Security Policy headers to provide defense-in-depth against XSS attacks
• Review user access and consider temporarily restricting comment functionality until patched

Patch Information

The vulnerability has been addressed in Gogs version 0.14.2. The fix restricts data: URI schemes to only safe image MIME types, preventing JavaScript execution through this attack vector. Detailed information about the security patch is available in the GitHub Security Advisory GHSA-xrcr-gmf5-2r8j and the GitHub Release v0.14.2. The specific code changes can be reviewed in GitHub Pull Request 8174.

Workarounds

• Deploy a reverse proxy with custom rules to strip or sanitize data: URIs from user-submitted content
• Implement strict Content Security Policy headers with script-src 'self' to block inline script execution
• Disable comment and issue description functionality temporarily if immediate patching is not possible
• Use browser extensions or enterprise policies to block data: URI execution in the Gogs domain

# Configuration example - Add CSP headers via reverse proxy (nginx)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';" always;