CVE-2026-52798: Gogs Git Service XSS Vulnerability

CVE-2026-52798 Overview

CVE-2026-52798 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Gogs, an open source self-hosted Git service. Versions prior to 0.14.3 sanitize .ipynb previews on the server side through the /-/api/sanitize_ipynb endpoint, but the sanitized content is re-rendered on the client side using marked() against elements with the .nb-markdown-cell class. The client-side re-rendering reintroduces dangerous URL schemes such as javascript:, enabling attackers to craft Jupyter notebooks that execute arbitrary JavaScript when a victim clicks a link. Gogs fixed the issue in version 0.14.3.

Critical Impact
An attacker with the ability to commit a malicious .ipynb file can execute arbitrary JavaScript in the Gogs origin when a victim views the file and clicks an attacker-controlled link, leading to session hijacking and account takeover.

Affected Products

Gogs versions prior to 0.14.3
Self-hosted Gogs instances rendering Jupyter Notebook (.ipynb) files
Deployments using the bundled marked-0.8.1 JavaScript library

Discovery Timeline

2026-06-24 - CVE-2026-52798 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-52798

Vulnerability Analysis

The vulnerability is a client-side stored XSS issue in the Jupyter Notebook preview path. Gogs sanitizes notebook content server side via /-/api/sanitize_ipynb, which removes dangerous constructs before transmission. However, the front-end then re-parses Markdown cells with the marked() function against elements tagged .nb-markdown-cell. The bundled marked-0.8.1 library does not validate URL schemes in its default link renderer, so a javascript: URI hidden inside a Markdown link is regenerated into the DOM unchanged.

The attacker commits a notebook file containing a Markdown link whose href uses a dangerous scheme. When another user views the notebook and clicks the link, the browser executes the embedded JavaScript in the Gogs origin. This yields full access to the victim's session cookies, CSRF tokens, and repository data.

Root Cause

The root cause is a trust boundary mismatch between server-side sanitization and client-side rendering. The server output is treated as safe, yet the client invokes marked() a second time without applying a URL scheme allowlist. marked-0.8.1 returns whatever href string it parses, so dangerous schemes such as javascript:, vbscript:, and data: survive into rendered anchor tags.

Attack Vector

Exploitation requires the attacker to push a crafted .ipynb file to a repository visible to the victim, then induce the victim to view the file and click the malicious link. Authentication is required to commit, but public repositories make this trivial. The user interaction requirement (a click) is the only friction.

text

// Patch: templates/repo/view_file.tmpl - reject dangerous URL schemes
// before they reach the DOM
var unsafeURLScheme = /^(?:javascript|vbscript|data):/i;
var escapeHTML = function (s) {
    return String(s).replace(/[&<>"']/g, function (c) {
        return {'&':'&','<':'<','>':'>','"':'"',"'":'''}[c];
    });
};
var decodeEntities = function (s) {
    var el = document.createElement('textarea');
    el.innerHTML = s;
    return el.value;
};
renderer.link = function (href, title, text) {
    var raw = String(href || '').trim();
    var normalized;
    try {
        normalized = decodeURIComponent(decodeEntities(raw));
    } catch (e) {
        normalized = decodeEntities(raw);
    }
    normalized = normalized.replace(/[\\x00-\\x20]/g, '');
    if (unsafeURLScheme.test(normalized)) {
        return text;
    }
    var out = '<a href="' + escapeHTML(raw) + '"';
};

Source: GitHub Commit 17b168b. The patch adds a custom renderer.link that decodes entities, strips control characters, and rejects javascript:, vbscript:, and data: schemes before emitting the anchor tag. The fix also upgrades the bundled library from marked-0.8.1 to marked-4.3.0.

Detection Methods for CVE-2026-52798

Indicators of Compromise

Commits adding .ipynb files that contain Markdown links with javascript:, vbscript:, or data: URI schemes.
Outbound requests from user browsers to attacker-controlled hosts immediately after viewing a notebook file in Gogs.
Unexpected session token exfiltration patterns originating from the Gogs origin in proxy logs.

Detection Strategies

Scan repository contents for .ipynb files whose Markdown cells contain href values matching (?i)^(javascript|vbscript|data):.
Inspect HTTP referrer chains where a notebook view in Gogs is immediately followed by cross-origin POSTs containing session identifiers.
Monitor Gogs application logs for repeated access to /-/api/sanitize_ipynb followed by notebook view requests against the same file.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture inline script and javascript: URI violations originating from notebook views.
Alert on Gogs user accounts that suddenly perform privileged actions (token creation, SSH key addition) shortly after viewing a notebook.
Audit new and modified .ipynb files in public repositories on a recurring basis.

How to Mitigate CVE-2026-52798

Immediate Actions Required

Upgrade Gogs to version 0.14.3 or later, which ships the patched link renderer and marked-4.3.0.
Audit existing repositories for .ipynb files containing dangerous URI schemes and remove or quarantine offending commits.
Rotate session cookies, API tokens, and SSH keys for any user who may have clicked links in untrusted notebooks.

Patch Information

The fix is delivered in Gogs v0.14.3 through pull request #8319 and commit 17b168b. Refer to GHSA-jq8v-rmf6-65jw for the upstream advisory. The patch adds URL scheme validation in the client renderer and upgrades the bundled marked library to 4.3.0.

Workarounds

Disable Jupyter Notebook rendering by restricting access to .ipynb previews until the upgrade is applied.
Deploy a strict Content Security Policy that forbids inline script execution and blocks javascript: URIs in anchor href attributes.
Restrict commit access to trusted users and require code review on all .ipynb contributions.

bash

# Upgrade Gogs to the patched release
wget https://github.com/gogs/gogs/releases/download/v0.14.3/gogs_0.14.3_linux_amd64.tar.gz
tar -xzf gogs_0.14.3_linux_amd64.tar.gz
systemctl stop gogs
cp -r gogs/* /opt/gogs/
systemctl start gogs

# Verify the bundled marked.js version
grep -r "marked-4.3.0" /opt/gogs/public/plugins/