CVE-2026-26276: Gogs: DOM-based XSS via milestone selection

March 5, 2026

It was confirmed in a test environment that an attacker can store an HTML/JavaScript payload in a repository’s Milestone name, and when another user selects that Milestone on the New Issue page (/issues/new), a DOM-Based XSS is triggered.

References

github.com/advisories/GHSA-vgjm-2cpf-4g7c
github.com/gogs/gogs
github.com/gogs/gogs/commit/9001a68cdda7bd9c078ffd6d1c4622905ac11e5c
github.com/gogs/gogs/pull/8178
github.com/gogs/gogs/releases/tag/v0.14.2
github.com/gogs/gogs/security/advisories/GHSA-vgjm-2cpf-4g7c
nvd.nist.gov/vuln/detail/CVE-2026-26276

Code Behaviors & Features

Detect and mitigate CVE-2026-26276 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →