CVE-2026-52807: Gogs has DOM-based XSS via Milestone Name on New Issue Page

June 23, 2026 (updated July 21, 2026)

The fix for GHSA-vgjm-2cpf-4g7c (DOM-based XSS via milestone selection) was only applied to templates/repo/issue/view_content.tmpl but not to templates/repo/issue/new_form.tmpl. An attacker can store an HTML/JavaScript payload in a milestone name, and when any user opens the New Issue page and interacts with the milestone dropdown, the payload executes in their browser via Semantic UI’s preserveHTML behavior.

References

github.com/advisories/GHSA-vcm5-gvmp-78mp
github.com/gogs/gogs/commit/573eacdc658641487f8ad883da96b29ec8e2852d
github.com/gogs/gogs/pull/8325
github.com/gogs/gogs/releases/tag/v0.14.3
github.com/gogs/gogs/security/advisories/GHSA-vcm5-gvmp-78mp
nvd.nist.gov/vuln/detail/CVE-2026-52807

Code Behaviors & Features

Detect and mitigate CVE-2026-52807 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →