DemoBook a demo

Vulnerability advisory

CVE-2021-28378

Published Updated OSV record ↗

Also known as BIT-gitea-2021-28378GHSA-g95p-88p4-76cmGO-2022-0832

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/go-gitea/gitea ↗
d6657644a96417d2e771a2891a54e99e686be0a3 through 53b89c34742855e0c5a7f989d6506f02791678afNo fix listed
03b7e11bd6125d4128cf99bc408723d1548f0613 to before 75496b9ff507ca5e9b7665f888f1156485e6532d75496b9ff507ca5e9b7665f888f1156485e6532d
Also listed as affected (17)
  • v1.13.3
  • v1.13.2
  • v1.13.1
  • v1.13.0
  • v1.12.6
  • v1.13.0-rc2
  • v1.13.0-rc1
  • v1.12.5
  • v1.12.4
  • v1.12.3
  • v1.12.2
  • v1.12.1
  • v1.12.0
  • v1.12.0-rc2
  • v1.12.0-rc1
  • v1.13.0-dev
  • v1.12.0-dev

Description

Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.