CVE-2026-26195: Gogs: Stored XSS in branch and wiki views through author and committer names

March 5, 2026

Stored XSS is still possible through unsafe template rendering that mixes user input with safe() plus permissive sanitizer handling of data URLs.

References

github.com/advisories/GHSA-vgvf-m4fw-938j
github.com/gogs/gogs
github.com/gogs/gogs/commit/ac21150a53bef3a3061f4da787ab193a8d68ecfc
github.com/gogs/gogs/pull/8176
github.com/gogs/gogs/releases/tag/v0.14.2
github.com/gogs/gogs/security/advisories/GHSA-vgvf-m4fw-938j
nvd.nist.gov/vuln/detail/CVE-2026-26195

Code Behaviors & Features

Detect and mitigate CVE-2026-26195 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →