| Package | Affected versions | Patched versions |
|---|---|---|
| gogs.io/gogs | ≤ 0.13.3all versions | |
| gogs | < 0.14.2 | 0.14.2 |
Stored XSS is still possible through unsafe template rendering that mixes user input with safe() plus permissive sanitizer handling of data URLs.
safe() still turns off escaping:
func safe(raw string) template.HTML { return template.HTML(raw) }Branch pages still render committer names using safe():
The locale still injects a raw second argument: conf/locale/locale_en-US.ini (branches.updated_by = updated %[1]s by %[2]s)
An attacker who can inject commit metadata such as author/committer name can trigger script execution on affected pages, leading to session abuse, CSRF token theft, or unauthorized actions.
A fix is available at https://github.com/gogs/gogs/releases/tag/v0.14.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free