Cross-Site Scripting Vulnerability in Gogs Git Service

CVE-2026-52816

What is CVE-2026-52816?

Gogs, an open-source Git service, has a vulnerability in its Jupyter Notebook sanitizer endpoint allowing arbitrary data URIs due to insufficient restrictions. This flaw can lead to Cross-Site Scripting (XSS), as it permits dangerous data URI schemes, enabling attackers to introduce malicious HTML or JavaScript. Additionally, the lack of authentication middleware means that any registered user can exploit this vulnerability, potentially compromising the integrity and security of the application. The issue is addressed and resolved in version 0.14.3.

References