CVE-2026-26276: Gogs Self-Hosted Git Service XSS Flaw

CVE-2026-26276 Overview

CVE-2026-26276 is a DOM-Based Cross-Site Scripting (XSS) vulnerability affecting Gogs, an open source self-hosted Git service. Prior to version 0.14.2, an attacker can store an HTML/JavaScript payload in a repository's Milestone name. When another user selects that Milestone on the New Issue page (/issues/new), the malicious payload is executed in the victim's browser context, enabling potential session hijacking, credential theft, or unauthorized actions on behalf of the victim.

Critical Impact

Authenticated attackers can execute arbitrary JavaScript in victim browsers when they interact with maliciously crafted Milestone names, potentially leading to account compromise and repository manipulation.

Affected Products

• Gogs versions prior to 0.14.2
• Self-hosted Git service deployments using vulnerable Gogs versions
• Organizations utilizing Gogs for internal code repository management

Discovery Timeline

• 2026-03-05 - CVE CVE-2026-26276 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-26276

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored DOM-Based XSS. The flaw exists in how Gogs handles Milestone name data when rendering the New Issue page. When a user with repository access creates or modifies a Milestone, they can inject HTML or JavaScript payloads into the Milestone name field. This input is stored server-side and later rendered without proper sanitization when other users access the issue creation interface.

The attack requires the attacker to have authenticated access to the repository with permissions to create or edit Milestones. The vulnerability affects confidentiality and integrity as arbitrary scripts can steal session tokens, modify repository settings, or perform actions on behalf of the victim user.

Root Cause

The root cause of this vulnerability is insufficient input validation and output encoding in the Milestone name handling logic. When Milestone data is rendered in the DOM on the New Issue page, the application fails to properly escape or sanitize the Milestone name before inserting it into the page. This allows specially crafted HTML and JavaScript content to be interpreted and executed by the browser rather than being displayed as plain text.

Attack Vector

The attack is executed over the network and requires user interaction. An authenticated attacker with repository access performs the following steps:

1. Creates or edits a Milestone within a target repository
2. Injects a malicious JavaScript payload into the Milestone name field (e.g., <script> tags or event handlers)
3. The payload is stored in the Gogs database
4. When a victim user navigates to the New Issue page and interacts with the Milestone selector, the malicious script executes in their browser context
5. The attacker can then steal session cookies, perform CSRF attacks, or manipulate the victim's session

The vulnerability mechanism involves improper handling of user-supplied input in the Milestone name field. When the New Issue page renders the Milestone dropdown, the name is inserted into the DOM without proper encoding, allowing injected scripts to execute. For detailed technical information, refer to the GitHub Security Advisory and Pull Request #8178.

Detection Methods for CVE-2026-26276

Indicators of Compromise

• Unusual or suspicious characters in Milestone names including <script>, <img>, onerror, onload, or other HTML/JavaScript patterns
• Browser console errors or unexpected JavaScript execution when accessing the New Issue page
• User reports of unexpected behavior or pop-ups when creating issues
• Audit logs showing Milestone creation or modification with suspicious payload patterns

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block common XSS patterns in form submissions
• Monitor Gogs database for Milestone entries containing HTML tags or JavaScript event handlers
• Review application logs for unusual POST requests to Milestone creation/edit endpoints
• Deploy browser-based XSS detection tools that alert on suspicious script execution

Monitoring Recommendations

• Enable verbose logging for Milestone CRUD operations in Gogs
• Configure SIEM alerts for patterns matching XSS payloads in web application logs
• Implement Content Security Policy (CSP) headers to restrict script execution sources
• Regularly audit repository Milestone names for suspicious content

How to Mitigate CVE-2026-26276

Immediate Actions Required

• Upgrade Gogs to version 0.14.2 or later immediately
• Audit existing Milestone names across all repositories for suspicious HTML/JavaScript content
• Review access logs for any evidence of exploitation attempts
• Consider implementing additional input validation at the reverse proxy or WAF level

Patch Information

Gogs has released version 0.14.2 which addresses this vulnerability. The patch implements proper output encoding for Milestone names when rendering them in the DOM. Organizations should upgrade to this version immediately. The fix is available via the GitHub Release v0.14.2, and technical details of the patch can be reviewed in Pull Request #8178.

Workarounds

• Restrict Milestone creation and editing permissions to trusted users only until the patch can be applied
• Implement a Content Security Policy (CSP) header with strict script-src directives to mitigate XSS impact
• Deploy a web application firewall with XSS detection rules in front of the Gogs instance
• Manually sanitize existing Milestone names by removing any HTML or JavaScript content

# Configuration example
# Add Content Security Policy headers in your reverse proxy (nginx example)
# This helps mitigate XSS attacks but is not a complete fix - upgrade to 0.14.2
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';" always;