CVE-2026-52807: Gogs Git Service XSS Vulnerability

CVE-2026-52807 Overview

CVE-2026-52807 is a stored Cross-Site Scripting (XSS) vulnerability in Gogs, an open source self-hosted Git service. The flaw affects versions prior to 0.14.3 and resides in the milestone dropdown component on the New Issue page. Attackers with permission to create milestones can store HTML or JavaScript payloads in milestone names. When other users open the New Issue page and interact with the milestone dropdown, the payload executes in their browsers. The issue stems from an interaction between Go's auto-escaping template engine and Semantic UI 2.4.2's preserveHTML: true default behavior, which re-parses decoded text as HTML.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in victims' browsers, enabling session theft, repository manipulation, or further account compromise within the Gogs instance.

Affected Products

Gogs versions prior to 0.14.3
Self-hosted Gogs Git service deployments
Instances using Semantic UI 2.4.2 dropdown components

Discovery Timeline

2026-06-24 - CVE-2026-52807 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-52807

Vulnerability Analysis

The vulnerability is a stored XSS [CWE-79] caused by inconsistent encoding between server-side template rendering and client-side DOM manipulation. In new_form.tmpl, milestone names are rendered using Go's default auto-escaping via {{.Name}}. This converts characters such as < to <, which prevents direct HTML injection at render time.

The browser then decodes the entity references when constructing the DOM text node. Semantic UI 2.4.2's dropdown component ships with preserveHTML: true as the default configuration. When a user selects an item from the dropdown, the internal set.text() method passes the item's text content through jQuery's .html() method.

This re-parses the decoded text as HTML, instantiating any injected elements and triggering event handlers such as onerror or onload. The original server-side escaping is effectively reversed at the client.

Root Cause

The root cause is a missing sanitization step on user-controlled milestone names before they are emitted into a Semantic UI dropdown. Go's contextual auto-escaping is sufficient for static HTML rendering but does not account for downstream JavaScript libraries that re-parse text content as HTML.

Attack Vector

An authenticated attacker with permission to create or edit milestones in a repository stores a crafted payload such as <img src=x onerror=alert(1)> as a milestone name. Any user who opens the New Issue page in that repository and interacts with the milestone dropdown triggers payload execution in their session context.

text

// Patch in templates/repo/issue/new_form.tmpl
                            {{.i18n.Tr "repo.issues.new.open_milestone"}}
                        </div>
                        {{range .OpenMilestones}}
-                            <div class="item" data-id="{{.ID}}" data-href="{{$.RepoLink}}/issues?milestone={{.ID}}"> {{.Name}}</div>
+                            <div class="item" data-id="{{.ID}}" data-href="{{$.RepoLink}}/issues?milestone={{.ID}}"> {{.Name | Sanitize}}</div>
                        {{end}}
                    {{end}}
                    {{if .ClosedMilestones}}

Source: Gogs commit 573eacd. The fix pipes milestone names through the Sanitize function, removing dangerous HTML before the dropdown component can re-parse it.

Detection Methods for CVE-2026-52807

Indicators of Compromise

Milestone names containing HTML tags, JavaScript event handlers (e.g., onerror, onload), or <script> markers
Unexpected outbound HTTP requests originating from authenticated user sessions when browsing repository issue pages
Anomalous session token usage or API calls following milestone interaction by privileged users

Detection Strategies

Query the Gogs database milestone table for names matching patterns such as <, >, javascript:, or common event handler attributes
Review web server access logs for POST requests to milestone creation or edit endpoints containing encoded HTML payloads
Inspect browser Content Security Policy (CSP) violation reports for inline script execution on /issues/new paths

Monitoring Recommendations

Enable audit logging for milestone creation and modification events in Gogs
Monitor for privilege escalation or repository configuration changes following a victim's visit to the New Issue page
Alert on session token reuse from unexpected IP addresses after a user accesses a repository containing suspicious milestones

How to Mitigate CVE-2026-52807

Immediate Actions Required

Upgrade all Gogs instances to version 0.14.3 or later, where milestone names are passed through the Sanitize template function
Audit existing milestones across all repositories for HTML or JavaScript content and remove or rename any malicious entries
Rotate session tokens and review recent administrative actions on instances that may have been exposed

Patch Information

The vulnerability is fixed in Gogs 0.14.3. The fix is implemented in pull request #8325 and commit 573eacd. See the GitHub Security Advisory GHSA-vcm5-gvmp-78mp and the v0.14.3 release notes for additional details.

Workarounds

Restrict milestone creation and editing privileges to trusted users until the patch is applied
Deploy a strict Content Security Policy that disallows inline script execution to limit the impact of stored XSS payloads
Place the Gogs instance behind a web application firewall configured to block HTML and JavaScript patterns in milestone API parameters

bash

# Upgrade Gogs to the patched release
wget https://github.com/gogs/gogs/releases/tag/v0.14.3
systemctl stop gogs
# Replace binary with v0.14.3 build, preserve custom/ and data/ directories
systemctl start gogs
# Verify version
gogs --version