Stored XSS Vulnerability in Gogs Self-Hosted Git Service

CVE-2026-52798

What is CVE-2026-52798?

Gogs, a self-hosted Git service, has a vulnerability stemming from improper sanitization of content in Jupyter Notebook files. Despite initial server-side sanitization, the rendered content is incorrectly processed client-side, allowing attackers to insert malicious JavaScript links. When a user interacts with the compromised .ipynb file, this script executes in the user's browser, potentially compromising user data and session integrity. This issue was addressed in version 0.14.3, emphasizing the importance of keeping software updated to mitigate such security risks.

References