CVE-2026-52807
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk38th percentile — higher than 38% of all known CVEs
Summary
Gogs is an open source Git service that prior to version 0.14.3 had an issue with rendering milestone names. The default auto-escaping in Go allowed for HTML/JavaScript injection through interaction with the dropdown in Semantic UI.
Risk Assessment
An attacker can inject malicious code that executes in users' browsers, potentially leading to data theft or session hijacking.
Recommendation
It is recommended to upgrade Gogs to version 0.14.3 or later to mitigate this vulnerability.
Original NVD description (English source)
Gogs is an open source self-hosted Git service. Prior to 0.14.3, in new_form.tmpl, milestone names are rendered with Go's default auto-escaping ({{.Name}}), which converts < to < etc. This prevents direct HTML injection. However, when the browser renders the DOM, the text content of the element contains the decoded original payload. Semantic UI 2.4.2's dropdown component has preserveHTML: true as the default setting. When a user selects a dropdown item, the internal set.text() method calls jQuery's .html() with the item's text content. This re-parses the decoded text as HTML, creating the injected element and triggering the JavaScript event handler. An attacker can store an HTML/JavaScript payload in a milestone name, and when any user opens the New Issue page and interacts with the milestone dropdown, the payload executes in their browser via Semantic UI's preserveHTML behavior. This vulnerability is fixed in 0.14.3.