Vulnerability advisory
CVE-2026-52816
Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS
Also known as GHSA-3w28-36p9-w929GO-2026-5103
- CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:P
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/gogs/gogs ↗ | |
| All commits before 3ba8aca90e17e5410b7e8b227c9f29256ac3e875 | 3ba8aca90e17e5410b7e8b227c9f29256ac3e875 |
| Not specified | dd1bd9837aa196b3ed3a8ee21e5727b5d7a986a3 |
Also listed as affected (60)
| |
Description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Jupyter Notebook (ipynb) sanitizer endpoint at POST /-/api/sanitize_ipynb allows arbitrary data: URIs without proper restrictions, potentially leading to Cross-Site Scripting (XSS). The endpoint uses bluemonday.UGCPolicy() with p.AllowURLSchemes("data") which permits all data URI schemes including data:text/html, enabling attackers to inject malicious HTML/JavaScript. Additionally, the endpoint has no authentication middleware, allowing any registered user to exploit this vulnerability. This vulnerability is fixed in 0.14.3.
References
- Webgithub.com/gogs/gogs/releases/tag/v0.14.3 ↗
- Advisorygithub.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52816.json ↗
- Advisorygithub.com/gogs/gogs/security/advisories/GHSA-3w28-36p9-w929 ↗
- Advisorynvd.nist.gov/vuln/detail/CVE-2026-52816 ↗
- Fixgithub.com/gogs/gogs/commit/dd1bd9837aa196b3ed3a8ee21e5727b5d7a986a3 ↗
- Fixgithub.com/gogs/gogs/pull/8326 ↗