| Package | Affected versions | Patched versions |
|---|---|---|
| code.gitea.io/gitea | ≥ 1.25.0, < 1.26.0 | 1.26.0 |
Me again.
Gitea's built-in 3D file viewer (powered by Online3DViewer) is vulnerable to stored cross-site scripting (XSS) through crafted .gltf files. When a glTF file declares an unsupported required extension, Online3DViewer generates an error message containing the extension name and Gitea inserts it into the DOM using innerHTML without sanitization. An attacker who can push a .gltf file to any repository can execute arbitrary JavaScript in the context of any user who views the file.
gitea:1.25-nightly (SHA e33d1da...), which bundles online-3d-viewer npm package v0.16.0When Online3DViewer parses a glTF file, it checks whether all extensionsRequired entries are supported. For unsupported extensions, it calls:
// In the Online3DViewer bundle (online-3d-viewer.js)
// Approximate offset 1142618 in the bundled chunk
this.SetError(yp("Unsupported extension: {0}.", unsupportedExtensions.join(", ")));
The SetError method stores this message, and Gitea's rendering code inserts it into the page using innerHTML:
// Gitea's error display handler
element.innerHTML = errorMessage; // unsanitized
The extension names from extensionsRequired are taken directly from the JSON file with no escaping or sanitization, allowing HTML injection.
.gltf file with a malicious extensionsRequired value:{
"asset": {"version": "2.0"},
"buffers": [],
"extensionsRequired": ["<img src=x onerror=\"alert(document.cookie)\">"],
"scenes": []
}
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeThe attacker pushes this file to any Gitea repository they have write access to (including forks of public repositories).
When any user navigates to the file's page in the Gitea web UI, the 3D viewer attempts to render it, encounters the "unsupported extension," and inserts the error message (containing the attacker's HTML) into the DOM via innerHTML.
The injected <img onerror> handler executes arbitrary JavaScript under the Gitea origin with the victim's authenticated session.
From the XSS context, an attacker can:
/user/settings/applications with the page's CSRF tokenfetch, XMLHttpRequest, or navigator.sendBeaconSave as poc.gltf and push to any Gitea 1.25+ repository:
{
"asset": {"version": "2.0"},
"buffers": [],
"extensionsRequired": ["<img src=x onerror=\"alert('XSS: '+document.domain)\">"],
"scenes": []
}
Navigate to the file in the Gitea web UI. The alert will fire.
Sanitize or text-encode the error message before DOM insertion. Replace innerHTML with textContent for error display:
// Instead of:
element.innerHTML = errorMessage;
// Use:
element.textContent = errorMessage;
Alternatively, escape HTML entities in the error message before insertion.
<iframe> with sandbox="allow-scripts" and a restrictive CSP (default-src 'none'), similar to how Gitea already handles SVG attachments