{"cve":"CVE-2026-52807","nvd":{"published":"2026-06-24T21:16:56.570","modified":"2026-06-25T16:16:38.727","status":"Deferred","description":"Gogs is an open source self-hosted Git service. Prior to 0.14.3, in new_form.tmpl, milestone names are rendered with Go's default auto-escaping ({{.Name}}), which converts < to &lt; etc. This prevents direct HTML injection. However, when the browser renders the DOM, the text content of the element contains the decoded original payload. Semantic UI 2.4.2's dropdown component has preserveHTML: true as the default setting. When a user selects a dropdown item, the internal set.text() method calls jQuery's .html() with the item's text content. This re-parses the decoded text as HTML, creating the injected element and triggering the JavaScript event handler. An attacker can store an HTML/JavaScript payload in a milestone name, and when any user opens the New Issue page and interacts with the milestone dropdown, the payload executes in their browser via Semantic UI's preserveHTML behavior. This vulnerability is fixed in 0.14.3.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","score":4.8},"cvss_v3":null,"cwes":["CWE-79"],"references":["https://github.com/gogs/gogs/commit/573eacdc658641487f8ad883da96b29ec8e2852d","https://github.com/gogs/gogs/pull/8325","https://github.com/gogs/gogs/releases/tag/v0.14.3","https://github.com/gogs/gogs/security/advisories/GHSA-vcm5-gvmp-78mp","https://github.com/gogs/gogs/security/advisories/GHSA-vcm5-gvmp-78mp"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:41:17.107060303+00:00"},"epss":{"cve":"CVE-2026-52807","score":0.00483,"percentile":0.41668,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-vcm5-gvmp-78mp","url":"https://osv.dev/vulnerability/GHSA-vcm5-gvmp-78mp","summary":"Gogs has DOM-based XSS via Milestone Name on New Issue Page","modified":"2026-07-21T13:45:25.149722139Z","packages":[{"ecosystem":"Go","name":"gogs.io/gogs","purl":"pkg:golang/gogs.io/gogs","ranges":["<0.14.3"],"fixed":["0.14.3"]}]},{"id":"GO-2026-5661","url":"https://osv.dev/vulnerability/GO-2026-5661","summary":"Gogs has DOM-based XSS via Milestone Name on New Issue Page in gogs.io/gogs","modified":"2026-06-25T23:01:25.579835663Z","packages":[{"ecosystem":"Go","name":"gogs.io/gogs","purl":"pkg:golang/gogs.io/gogs","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}