Vulnerability advisory

BIT-gitea-2025-68942

Published Jan 3, 2026Updated Sep 8, 2026OSV record ↗

Severity

Severity not reported.

Affected versions

Affected Fixed in

All versions before 1.22.2 1.22.2

Affected	Fixed in
All versions before 1.22.2	`1.22.2`
Severity for this package CVSS 3.x`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`

Severity for this package

Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text.